CVE-2006-0039 : Race condition in the do_add_counters function in netfilter for Linux kernel 2.6

Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way that produces a size value that is inconsistent with allocated memory, which leads to a buffer over-read in IPT_ENTRY_ITERATE.

Published 2006-05-19 22:02:00

Updated 2023-02-13 02:16:12

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2006-0039

Linux » Linux Kernel » Version: 2.6.16
cpe:2.3:o:linux:linux_kernel:2.6.16:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2006-0039

Top countries where our scanners detected CVE-2006-0039

Top open port discovered on systems with this issue 554

IPs affected by CVE-2006-0039 7

Find out if you^* are affected by CVE-2006-0039!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2006-0039

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2006-0039

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.7	MEDIUM	AV:L/AC:H/Au:N/C:P/I:N/A:C	1.9	7.8	NIST
Access Vector: Local Access Complexity: High Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Complete

CWE ids for CVE-2006-0039

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2006-0039