Bug 1618227 (CVE-2006-5823)

Summary:	CVE-2006-5823 security flaw
Product:	[Other] Security Response	Reporter:	Stephen Herr <sherr>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-08-16 12:43:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Stephen Herr 2018-08-16 12:43:09 UTC

Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.

Comment 1 Stephen Herr 2018-08-16 16:51:13 UTC

MITRE description:

The zlib_inflate function in Linux kernel 2.6.x allows local users to cause a denial of service (crash) via a malformed filesystem that uses zlib compression that triggers memory corruption, as demonstrated using cramfs.

Comment 2 Stephen Herr 2019-06-13 19:31:00 UTC

Statement:

The CVE-2006-5823 is about a corrupted cramfs (MOKB-07-11-2006) that can cause a memory corruption and so crash the machine.

For Red Hat Enterpise Linux 3 this issue is tracked via Bugzilla #216960 and for Red Hat Enterprise Linux 4 it is tracked via Bugzilla #216958.

Red Hat Enterprise Linux 2.1 is not vulnerable to this issue.

This issue has been rated as having low impact, because root privileges or physical access to the machine are needed to mount a corrupted filesystem and crash the machine.

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.