CVE-2004-1235 Race condition in n/a
Local attackers can exploit a race condition in the Linux kernel's uselib function to execute arbitrary code and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2004-1235?
CVE-2004-1235 is a medium-severity vulnerability in Conectiva Linux, published on 20 Jan 2005. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.
Which versions are affected by CVE-2004-1235?
It affects 20 products.
Products include Avaya Converged Communications Server, Avaya Intuity Audix, Avaya Mn100, Avaya Modular Messaging Message Storage Server, Avaya Network Routing, Avaya S8300 and 14 more.
How do I fix CVE-2004-1235?
Apply the vendor's patch.
Is CVE-2004-1235 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-1235 exists.
Public exploit code: 3 Exploit-DB entries.
Other vulnerabilities in Conectiva Linux
Sources
Also known as GHSA-pxmj-v2v3-474h.