CVE-2004-0177

Description

The ext3 code in Linux 2.4.x before 2.4.26 does not properly initialize journal descriptor blocks, which causes an information leak in which in-memory data is written to the device for the ext3 file system, which allows privileged users to obtain portions of kernel memory by reading the raw device.

5.0

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 1.24% Top 25%

Vendor Advisory marc.info Vendor Advisory fedora.us Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory com.br Vendor Advisory debian.org Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory linuxsecurity.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory mandriva.com Vendor Advisory gentoo.org Vendor Advisory redhat.com Vendor Advisory debian.org

Affected: n/a n/a

References

Link	Tags
http://www.ciac.org/ciac/bulletins/o-127.shtml	third party advisory government resource
http://marc.info/?l=bugtraq&m=108213675028441&w=2	vendor advisory
https://bugzilla.fedora.us/show_bug.cgi?id=2336	vendor advisory
http://www.debian.org/security/2004/dsa-482	vendor advisory
http://www.debian.org/security/2004/dsa-495	patch vendor advisory
http://www.debian.org/security/2004/dsa-479	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15867	vdb entry
http://www.debian.org/security/2004/dsa-480	vendor advisory
http://www.securityfocus.com/bid/10152	vdb entry
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000846	vendor advisory
http://www.debian.org/security/2004/dsa-489	vendor advisory
http://www.debian.org/security/2004/dsa-481	vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10556	signature vdb entry
http://www.redhat.com/support/errata/RHSA-2005-293.html	vendor advisory
http://www.linuxsecurity.com/advisories/engarde_advisory-4285.html	patch vendor advisory
http://www.redhat.com/support/errata/RHSA-2004-505.html	vendor advisory
http://www.ciac.org/ciac/bulletins/o-121.shtml	third party advisory government resource
http://www.ciac.org/ciac/bulletins/o-126.shtml	third party advisory government resource
http://www.redhat.com/support/errata/RHSA-2004-504.html	vendor advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2004:029	vendor advisory
http://security.gentoo.org/glsa/glsa-200407-02.xml	vendor advisory
http://rhn.redhat.com/errata/RHSA-2004-166.html	patch vendor advisory
http://linux.bkbits.net:8080/linux-2.4/cset%404056b368s6vpJbGWxDD_LhQNYQrdzQ
http://www.debian.org/security/2004/dsa-491	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2004-0177?: CVE-2004-0177 has been scored as a medium severity vulnerability.
How to fix CVE-2004-0177?: To fix CVE-2004-0177, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2004-0177 being actively exploited in the wild?: It is possible that CVE-2004-0177 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.