NVD

Id
1325  
Name
CVE-2008-1367  
Description
gcc 4.3.x does not generate a cld instruction while compiling functions used for string manipulation such as memcpy and memmove on x86 and i386, which can prevent the direction flag (DF) from being reset in violation of ABI conventions and cause data to be copied in the wrong direction during signal handling in the Linux kernel, which might allow context-dependent attackers to trigger memory corruption. NOTE: this issue was originally reported for CPU consumption in SBCL.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-03  
Published
2008-03-17  
Modified Date
2011-03-07  
Seq
2008-1367  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
8336 1325 CVE-2008-1367 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469058  View
8337 1325 CVE-2008-1367 [gcc-patches] 20080306 [PATCH, i386]: Emit cld instruction when stringops are used  View
8338 1325 CVE-2008-1367 [gcc-patches] 20080306 Re: [PATCH, i386]: Emit cld instruction when stringops are used  View
8339 1325 CVE-2008-1367 [gcc-patches] 20080306 Re: [PATCH, i386]: Emit cld instruction when stringops are used  View
8340 1325 CVE-2008-1367 [gcc-patches] 20080307 Re: [PATCH, i386]: Emit cld instruction when stringops are used  View
8341 1325 CVE-2008-1367 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e40cd10ccff3d9fbffd57b93780bee4b7b9bff51  View
8342 1325 CVE-2008-1367 SUSE-SA:2008:030  View
8343 1325 CVE-2008-1367 SUSE-SA:2008:031  View
8344 1325 CVE-2008-1367 SUSE-SA:2008:032  View
8345 1325 CVE-2008-1367 [Security-announce] 20080728 VMSA-2008-00011 Updated ESX service console packages for Samba and vmnix  View
8346 1325 CVE-2008-1367 [linux-kernel] 20080305 Linux doesn"t follow x86/x86-64 ABI wrt direction flag  View
8347 1325 CVE-2008-1367 http://lwn.net/Articles/272048/#Comments  View
8348 1325 CVE-2008-1367 [git-commits-head] 20080307 x86: clear DF before calling signal handler  View
8349 1325 CVE-2008-1367 oval:org.mitre.oval:def:11108  View
8350 1325 CVE-2008-1367 RHSA-2008:0508  View
8351 1325 CVE-2008-1367 RHSA-2008:0211  View
8352 1325 CVE-2008-1367 RHSA-2008:0233  View
8353 1325 CVE-2008-1367 29084  View
8354 1325 CVE-2008-1367 ADV-2008-2222  View
8355 1325 CVE-2008-1367 gcc-cld-dos(41340)  View
8356 1325 CVE-2008-1367 https://bugzilla.redhat.com/show_bug.cgi?id=437312  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46033 JVNDB-2008-001343 gcc における cld 命令を生成しないことによるメモリ破壊の脆弱性 gcc には x86 システムや i386 システム上において、memcpy() 関数や memmove() 関数のような文字列操作のためのコンパイル処理を行う際、ABI 規約の違反によるダイレクションフラグ (DF) のリセットを妨害されることによって、cld 命令を生成されないため、Linux カーネルによるシグナルハンドリングを行う際に誤ってダイレクションにデータがコピーされるメモリ破壊の脆弱性が存在します。 CVE-2008-1367 31480 CVE-2008-1367 1325 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001343.html 2008-03-17 2008-10-28 View