Skip to content
OpenAdvisories
Unscored Public exploit CVE-2004-0077 EUVD-2004-0077GHSA-pm7j-3492-hq9m

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the retu…

Published Sep 1, 2004 · Updated Aug 8, 2024 · Assigned by mitre

Description

The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 3.0 kernel-image-2.2.10-powerpc-apus 2.2.10-13woody1 DSA-466
Debian 3.0 kernel-image-2.2.20-amiga 2.20-4 DSA-453
Debian 3.0 kernel-image-2.2.20-i386 2.2.20-5woody5 DSA-453
Debian 3.0 kernel-image-2.2.20-mac +4 2.2.20-3 DSA-453
Debian 3.0 kernel-image-2.2.20-reiserfs-i386 2.2.20-4woody1 DSA-453
Debian 3.0 kernel-image-2.2.22-alpha 2.2.22-2 DSA-454
Debian 3.0 kernel-image-2.4.16-lart +2 2.4.16-20040204 DSA-439
Debian 3.0 kernel-image-2.4.17-hppa 32.3 DSA-470
Debian 3.0 kernel-image-2.4.17-ia64 011226.16 DSA-444
Debian 3.0 kernel-image-2.4.17-s390 2.4.17-2.woody.3 DSA-442
Debian 3.0 kernel-image-2.4.18-1-alpha 2.4.18-14 DSA-438
Debian 3.0 kernel-image-2.4.18-1-i386 2.4.18-12.2 DSA-438
Debian 3.0 kernel-image-2.4.18-hppa 62.1 DSA-475
Debian 3.0 kernel-image-2.4.18-i386bf 2.4.18-5woody7 DSA-438
Debian 3.0 kernel-patch-2.2.19-arm +2 20040303 DSA-456
Debian 3.0 kernel-patch-2.2.20-powerpc 2.2.20-3woody1 DSA-453
Debian 3.0 kernel-patch-2.4.16-arm 20040204 DSA-439
Debian 3.0 kernel-patch-2.4.17-mips 2.4.17-0.020226.2.woody5 DSA-441
Debian 3.0 kernel-patch-2.4.17-s390 0.0.20020816-0.woody.2 DSA-442
Debian 3.0 kernel-patch-2.4.18-powerpc 2.4.18-1woody4 DSA-438
Debian 3.0 kernel-patch-2.4.19-mips 2.4.19-4.woody1 DSA-450
Debian 3.0 kernel-source-2.2.10 2.2.10-2 DSA-466
Debian 3.0 kernel-source-2.2.19 2.2.19.1-4woody1 DSA-456
Debian 3.0 kernel-source-2.2.20 2.2.20-5woody3 DSA-514, DSA-453
Debian 3.0 kernel-source-2.2.22 2.2.22-1woody1 DSA-454
Debian 3.0 kernel-source-2.4.17 +1 2.4.17-4 DSA-440
Debian 3.0 kernel-source-2.4.18 2.4.18-14.2 DSA-438
Debian 3.0 kernel-source-2.4.19 2.4.19-0.020911.1.woody3 DSA-450

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 3 kernel +8 2.4.21-9.0.1.EL RHSA-2004:066
RHEL 3 s390utils 2:1.2.4-3 RHSA-2004:066

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 2

GitHub 1 repository

  • 0b0111100/2004 ★ 0 · Sep 7, 2026

    Linux Kernel Exploits -> CVE-2004-0077 + CVE-2004-1235 + caps_to_root

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 15

References