Description
The do_coredump function in fs/exec.c in the Linux kernel 2.6.19 sets the flag variable to O_EXCL but does not use it, which allows context-dependent attackers to modify arbitrary files via a rewrite attack during a core dump.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +11 | 2.6.18-164.11.1.el5 | RHSA-2010:0046 |
Advisories 1
- RHSA-2010:0046 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 21591 vdb-entry
- oval:org.mitre.oval:def:7446 vdb-entry signature
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19.1
- 23349 third-party-advisory
- http://support.avaya.com/css/P8/documents/100073666
- oval:org.mitre.oval:def:10797 vdb-entry signature
- RHSA-2010:0095 vendor-advisory
- ADV-2006-5002 vdb-entry
- RHSA-2010:0046 vendor-advisory
- 2006-0074 vendor-advisory