Description
Stack-based buffer overflow in the random number generator (RNG) implementation in the Linux kernel before 2.6.22 might allow local root users to cause a denial of service or gain privileges by setting the default wakeup threshold to a value greater than the output pool size, which triggers writing random numbers to the stack by the pool transfer function involving "bound check ordering". NOTE: this issue might only cross privilege boundaries in environments that have granular assignment of privileges for root.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-13etch2 | DSA-1363-1 |
| Debian 3.1 | fai-kernels | 1.9.1sarge8 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-hppa | 2.6.8-7sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-ia64 | 2.6.8-15sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-m68k | 2.6.8-5sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-s390 | 2.6.8-6sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-image-2.6.8-sparc | 2.6.8-16sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-patch-powerpc-2.6.8 | 2.6.8-13sarge1 | DSA-1504-1 |
| Debian 3.1 | kernel-source-2.6.8 +3 | 2.6.8-17sarge1 | DSA-1504-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +9 | 2.6.18-8.1.15.el5 | RHSA-2007:0940 |
| RHEL 4 | kernel +10 | 2.6.9-55.0.12.EL | RHSA-2007:0939 |
Advisories 4
- RHSA-2007:0940 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2007:0939 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1504-1 kernel-image-2.6.8 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1363-1 linux-2.6 Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2007:0940 vendor-advisory
- oval:org.mitre.oval:def:10371 vdb-entry signature
- 27747 third-party-advisory
- 27212 third-party-advisory
- 27227 third-party-advisory
- 26664 third-party-advisory
- 26643 third-party-advisory
- SUSE-SA:2007:051 vendor-advisory
- SUSE-SA:2007:053 vendor-advisory
- 27322 third-party-advisory
- DSA-1363 vendor-advisory
- 26651 third-party-advisory
- https://issues.rpath.com/browse/RPL-1650
- RHSA-2007:0939 vendor-advisory
- USN-510-1 vendor-advisory
- DSA-1504 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-474.htm
- 25348 vdb-entry
- USN-509-1 vendor-advisory
- 26647 third-party-advisory
- MDKSA-2007:216 vendor-advisory
- MDKSA-2007:196 vendor-advisory
- 29058 third-party-advisory
- 26500 third-party-advisory
- USN-508-1 vendor-advisory
- 27436 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.22-git14.log
- MDKSA-2007:195 vendor-advisory