CVE-2005-4605

An attacker can read sensitive kernel memory by exploiting a flaw in the procfs code. This is achieved by providing specific input that triggers an integer overflow when a signed value is added to an unsigned value. The exploit code demonstrates seeking to a large offset in `/proc/uptime` to trigger this vulnerability and dump kernel memory to standard output [ref_id=1].

The vulnerability resides in the procfs code, specifically within the file `fs/proc/proc_misc.c` [ref_id=2]. The issue arises from the calculation `len <= off+count`, where `off` is of type `off_t` (signed) and `count` is of type `int` (signed). This calculation is also present in other kernel modules, including those related to `ia64`, `ppc64`, and various `drivers/char` and `drivers/net` files [ref_id=2].

The advisory does not specify a patch or provide details on the fix. However, the vulnerability is described as occurring in Linux versions before 2.6.15. The root cause is the improper handling of signed and unsigned integer types during offset calculations in the procfs code, specifically in `fs/proc/proc_misc.c` [ref_id=2].

[+] Opened /proc/uptime. [+] Seek to offset 4294963199. [+] Read 4096 bytes, dumping to stdout... ...