Description
The elf_core_dump function in binfmt_elf.c for Linux kernel 2.x.x to 2.2.27-rc2, 2.4.x to 2.4.31-pre1, and 2.6.x to 2.6.12-rc4 allows local users to execute arbitrary code via an ELF binary that, in certain conditions involving the create_elf_tables function, causes a negative length argument to pass a signed integer comparison, leading to a buffer overflow.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kernel +8 | 2.4.21-32.0.1.EL | RHSA-2005:472 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Linux Kernel 2.2.x/2.3.x/2.4.x/2.5.x/2.6.x - ELF Core Dump Local Buffer Overflow (PoC) EDB-25647 · dos · May 11, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2005:472 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- oval:org.mitre.oval:def:1122 vdb-entry signature
- ADV-2005-0524 vdb-entry
- http://www.isec.pl/vulnerabilities/isec-0023-coredump.txt
- 19185 third-party-advisory
- 19607 third-party-advisory
- FLSA:157459-2 vendor-advisory
- RHSA-2005:472 vendor-advisory
- oval:org.mitre.oval:def:10909 vdb-entry signature
- 13589 vdb-entry
- 20050511 Linux kernel ELF core dump privilege elevation mailing-list
- FLSA:157459-1 vendor-advisory
- RHSA-2005:551 vendor-advisory
- RHSA-2005:529 vendor-advisory
- FLSA:157459-3 vendor-advisory