CVE-2004-2536

Vulnerability

The Linux kernel versions 2.6 through 2.6.5 contain a vulnerability in the exit_thread function in process.c. When a process obtains IO access permissions via the ioperm system call but does not drop those permissions before exiting, the kernel fails to invalidate the per-TSS (Task State Segment) io_bitmap pointers. This leaves the pointers dangling, allowing other processes to access them.

Exploitation

An attacker with local access to the system can exploit this by creating a process that acquires IO permissions using ioperm and then exits without revoking them. Subsequently, another process (or the same process after reincarnation) can access the stale TSS pointers, potentially reading or writing restricted memory locations. No special privileges are required beyond the ability to execute code.

Impact

Successful exploitation allows an attacker to access restricted memory locations, which can lead to information disclosure or privilege escalation. The attacker may gain elevated privileges, potentially compromising the entire system.

Mitigation

The vulnerability was fixed in Linux kernel version 2.6.6. Users should upgrade to a kernel version 2.6.6 or later. No workarounds are documented. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.