CVE-2007-6206

Published: Dec 4, 2007Modified: Apr 23, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

The do_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.

Affected (22)

Products: Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Real Time Extension, Linux Enterprise Server, Linux Enterprise Software Development Kit · +3 more

Show all products

Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Real Time Extension, Linux Enterprise Server, Linux Enterprise Software Development Kit · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Workstation · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

4 products

Linux Enterprise Desktop

Linux Enterprise Real Time Extension

Linux Enterprise Server

Linux Enterprise Software Development Kit

Redhat

4 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 2.4.0 to 2.4.35.2
Linux Linux Kernel	From 2.6.0 to 2.6.24
Linux Linux Kernel	Version 2.6.24
Linux Linux Kernel	Version 2.6.24 rc1
Linux Linux Kernel	Version 2.6.24 rc2
Linux Linux Kernel	Version 2.6.24 rc3

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 10.2
Opensuse Opensuse	Version 10.3
Suse Linux Enterprise Desktop	Version 10 sp1
Suse Linux Enterprise Real Time Extension	Version 10 sp1
Suse Linux Enterprise Server	Version 10 sp1
Suse Linux Enterprise Software Development Kit	Version 10 sp1

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 4.0
Redhat Enterprise Linux Eus	Version 4.6
Redhat Enterprise Linux Server	Version 4.0
Redhat Enterprise Linux Workstation	Version 4.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1
Debian Debian Linux	Version 4.0

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 6.10
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (78)

http://bugzilla.kernel.org/show_bug.cgi?id=3043

Source: cve@mitre.org

Issue TrackingVendor Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=c46f739dd39db3b07ab5deb4e3ec81e1c04a91af

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00005.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://lists.vmware.com/pipermail/security-announce/2008/000023.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2008-0055.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/27908

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28141

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28643

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28706

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28748

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28826

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28889

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/28971

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/29058

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30110

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30818

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/30962

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/31246

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/33280

Source: cve@mitre.org

Third Party Advisory

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0048

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2007/dsa-1436

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1503

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1504

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:044

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:086

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:112

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0089.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0211.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0787.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/487808/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/26701

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-574-1

Source: cve@mitre.org

Third Party Advisory

http://www.ubuntu.com/usn/usn-578-1

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2007/4090

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/2222/references

Source: cve@mitre.org

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/38841

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10719

Source: cve@mitre.org

Third Party Advisory

http://bugzilla.kernel.org/show_bug.cgi?id=3043