Description
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | hostap-modules-i386 | 1:0.3.7-1sarge3 | DSA-1503-1 |
| Debian 3.1 | i2c | 1:2.9.1-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-arm +1 | 2.4.27-2sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-m68k | 2.4.27-3sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-2.4.27-sparc | 2.4.27-9sarge6 | DSA-1503-1 |
| Debian 3.1 | kernel-image-speakup-i386 | 2.4.27-1.1sarge5 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-alpha | 101sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-i386 | 101sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-s390 | 2.4.27-1sarge2 | DSA-1503-1 |
| Debian 3.1 | kernel-latest-2.4-sparc | 42sarge3 | DSA-1503-1 |
| Debian 3.1 | kernel-patch-2.4.27-mips | 2.4.27-10.sarge4.040815-3 | DSA-1503-1 |
| Debian 3.1 | kernel-source-2.4.27 +4 | 2.4.27-10sarge6 | DSA-1503-2, DSA-1503-1 |
| Debian 3.1 | mindi-kernel | 2.4.27-2sarge5 | DSA-1503-1 |
| Debian 3.1 | pcmcia-modules-2.4.27-i386 | 3.2.5+2sarge2 | DSA-1503-1 |
| Debian 3.1 | systemimager | 3.2.3-6sarge5 | DSA-1503-1 |
Advisories 2
- DSA-1503-2 kernel-source-2.4.27 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1503-1 kernelimage-2.4.27 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- 11981 third-party-advisory
- 7345 vdb-entry
- 1010617 vdb-entry
- 8363 vdb-entry
- 20040629 linux kernel Sbus PROM driver multiple integer overflows mailing-list
- DSA-1503 vendor-advisory
- 29058 third-party-advisory
- http://www.securiteam.com/unixfocus/5GP0515DFW.html
- 10632 vdb-entry