CVE-2004-0177

The ext3 code in Linux 2.4.x before 2.4.26 does not properly initialize journal descriptor blocks, which causes an information leak in which in-memory data is written to the device for the ext3 file system, which allows privileged users to obtain portions of kernel memory by reading the raw device.

🔗 References (48)

• cve@mitrehttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846
• cve@mitrehttp://linux.bkbits.net:8080/linux-2.4/cset%404056b368s6vpJbGWxDD_LhQNYQrdzQ
• cve@mitrehttp://marc.info/?l=bugtraq&m=108213675028441&w=2
• cve@mitrehttp://rhn.redhat.com/errata/RHSA-2004-166.html
• cve@mitrehttp://security.gentoo.org/glsa/glsa-200407-02.xml
• cve@mitrehttp://www.ciac.org/ciac/bulletins/o-121.shtml
• cve@mitrehttp://www.ciac.org/ciac/bulletins/o-126.shtml
• cve@mitrehttp://www.ciac.org/ciac/bulletins/o-127.shtml
• cve@mitrehttp://www.debian.org/security/2004/dsa-479
• cve@mitrehttp://www.debian.org/security/2004/dsa-480
• cve@mitrehttp://www.debian.org/security/2004/dsa-481
• cve@mitrehttp://www.debian.org/security/2004/dsa-482
• cve@mitrehttp://www.debian.org/security/2004/dsa-489
• cve@mitrehttp://www.debian.org/security/2004/dsa-491
• cve@mitrehttp://www.debian.org/security/2004/dsa-495