CVE-2006-5749

LOW1.7/ 10.0
Share:
Published: December 31, 2006 at 05:00 AM
Modified: April 9, 2025 at 12:30 AM
Source: secalert@redhat.com

Vulnerability Description

The isdn_ppp_ccp_reset_alloc_state function in drivers/isdn/isdn_ppp.c in the Linux 2.4 kernel before 2.4.34-rc4 does not call the init_timer function for the ISDN PPP CCP reset state timer, which has unknown attack vectors and results in a system crash.

CVSS Metrics

Base Score
1.7
Severity
LOW
Vector String
AV:L/AC:L/Au:S/C:N/I:N/A:P

Weaknesses (CWE)

NVD-CWE-Other
Source: nvd@nist.gov

AI Security Analysis

01 // Technical Summary

Linux kernel versions 2.4.x are vulnerable to a denial-of-service (DoS) attack due to a missing timer initialization in the ISDN PPP CCP reset function. This flaw allows an attacker to trigger a kernel panic, rendering the system unusable and potentially leading to data loss.

02 // Vulnerability Mechanism

Step 1: Trigger ISDN PPP CCP Reset: An attacker must initiate a reset of the ISDN PPP CCP (Compression Control Protocol). This can be achieved by sending specific network packets or manipulating ISDN PPP configuration.

Step 2: Function Call: The isdn_ppp_ccp_reset_alloc_state function is called as part of the reset process.

Step 3: Missing Initialization: The function fails to call init_timer on the ISDN PPP CCP reset state timer.

Step 4: Timer Use: The uninitialized timer is later used by the kernel, either directly or indirectly.

Step 5: Kernel Panic: Due to the uninitialized timer, the kernel attempts to access invalid memory locations, resulting in a kernel panic and system crash.

03 // Deep Technical Analysis

The vulnerability lies within the isdn_ppp_ccp_reset_alloc_state function in drivers/isdn/isdn_ppp.c of the Linux 2.4 kernel. The function fails to initialize the init_timer structure for the ISDN PPP CCP reset state timer. This means the timer is not properly set up before being used. When the timer is triggered (or attempted to be used), the kernel attempts to access uninitialized memory, leading to a kernel panic and system crash. The root cause is a missing call to init_timer(&timer_variable) before the timer is used. This results in undefined behavior and a crash when the timer expires or is accessed.

References & Intelligence

http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.34
Source: secalert@redhat.com
http://secunia.com/advisories/23529
Source: secalert@redhat.com
Patch
http://secunia.com/advisories/23609
Source: secalert@redhat.com
http://secunia.com/advisories/23752
Source: secalert@redhat.com
http://secunia.com/advisories/24098
Source: secalert@redhat.com
http://secunia.com/advisories/24100
Source: secalert@redhat.com
http://secunia.com/advisories/24547
Source: secalert@redhat.com
http://secunia.com/advisories/25226
Source: secalert@redhat.com
http://secunia.com/advisories/25683
Source: secalert@redhat.com
http://secunia.com/advisories/25691
Source: secalert@redhat.com
http://www.kernel.org/git/?p=linux/kernel/git/wtarreau/linux-2.4.git%3Ba=commitdiff%3Bh=05dca9b77f99d80cf615075624666106d5b61727
Source: secalert@redhat.com
http://www.mandriva.com/security/advisories?name=MDKSA-2007:012
Source: secalert@redhat.com
http://www.mandriva.com/security/advisories?name=MDKSA-2007:025
Source: secalert@redhat.com
http://www.mandriva.com/security/advisories?name=MDKSA-2007:040
Source: secalert@redhat.com
http://www.novell.com/linux/security/advisories/2007_18_kernel.html
Source: secalert@redhat.com
http://www.novell.com/linux/security/advisories/2007_21_kernel.html
Source: secalert@redhat.com
http://www.novell.com/linux/security/advisories/2007_30_kernel.html
Source: secalert@redhat.com
http://www.novell.com/linux/security/advisories/2007_35_kernel.html
Source: secalert@redhat.com
http://www.securityfocus.com/archive/1/471457
Source: secalert@redhat.com
http://www.securityfocus.com/bid/21835
Source: secalert@redhat.com
http://www.securityfocus.com/bid/21883
Source: secalert@redhat.com
http://www.trustix.org/errata/2007/0002/
Source: secalert@redhat.com
http://www.ubuntu.com/usn/usn-416-1
Source: secalert@redhat.com
http://kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.34
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/23529
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
http://secunia.com/advisories/23609
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/23752
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/24098
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/24100
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/24547
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/25226
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/25683
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/25691
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.kernel.org/git/?p=linux/kernel/git/wtarreau/linux-2.4.git%3Ba=commitdiff%3Bh=05dca9b77f99d80cf615075624666106d5b61727
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.mandriva.com/security/advisories?name=MDKSA-2007:012
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.mandriva.com/security/advisories?name=MDKSA-2007:025
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.mandriva.com/security/advisories?name=MDKSA-2007:040
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.novell.com/linux/security/advisories/2007_18_kernel.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.novell.com/linux/security/advisories/2007_21_kernel.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.novell.com/linux/security/advisories/2007_30_kernel.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.novell.com/linux/security/advisories/2007_35_kernel.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/archive/1/471457
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/21835
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/21883
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.trustix.org/errata/2007/0002/
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.ubuntu.com/usn/usn-416-1
Source: af854a3a-2127-422b-91ae-364da2661108
CVE-2006-5749 - LOW Severity (1.7) | Free CVE Database | 4nuxd