Secunia

Paul Starzetz has reported a vulnerability in the Linux kernel, which can be exploited by malicious, local users to gain escalated privileges on a vulnerable system.

The problem is that the "mremap()" system call doesn't check values returned by the "do_munmap()" kernel function when moving VMAs (Virtual Memory Areas) or parts thereof.

Successful exploitation allows execution of arbitrary code with kernel level privileges.

The following versions are reportedly affected:
* Branch 2.2.x up to 2.2.25
* Branch 2.4.x up to 2.4.24
* Branch 2.6.x up to 2.6.2

An exploit is available.

NOTE: This is not the same vulnerability as the one reported early January 2004 in the same system call.

Solution
Update to a non-vulnerable version.
Further details available in Customer Area

Provided and/or discovered by
Paul Starzetz

Changelog
Further details available in Customer Area

Original Advisory
http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area