What’s Vulnerable › Vulnerabilities
CVE-2007-6206
- Severity: low (CVSS 2.1 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2007-12-04 · updated 2026-06-16
- Weakness: CWE-200
Description
The do_coredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive information.
Affected products
- Canonical Ubuntu Linux: 6.06, 6.10, 7.04, 7.10
- Debian Linux: 3.1, 4.0
- Linux kernel: from 2.4.0 through 2.4.35.2; from 2.6.0 before 2.6.24; 2.6.24, 2.6.24-rc1, 2.6.24-rc2, 2.6.24-rc3 — fixed in 2.6.24
- Opensuse: 10.2, 10.3
- RedHat Enterprise Linux Desktop: 4.0
- RedHat Enterprise Linux Eus: 4.6
- RedHat Enterprise Linux Server: 4.0
- RedHat Enterprise Linux Workstation: 4.0
- SUSE Linux Enterprise Server 15 SP1: 10-sp1
- SUSE Linux Enterprise Real Time Extension: 10-sp1
- SUSE Linux Enterprise Server: 10-sp1
- SUSE Linux Enterprise Software Development Kit: 10-sp1
How to fix
Upgrade to a fixed version: Linux kernel 2.6.24. Check the vendor advisory for mitigations.
References
- http://bugzilla.kernel.org/show_bug.cgi?id=3043
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=c46f739dd39db3b07ab5deb4e3ec81e1c04a91af
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00002.html
- http://lists.vmware.com/pipermail/security-announce/2008/000023.html
- http://rhn.redhat.com/errata/RHSA-2008-0055.html
- http://secunia.com/advisories/27908
- http://secunia.com/advisories/28141
- http://secunia.com/advisories/28643
- http://secunia.com/advisories/28706
- http://secunia.com/advisories/28748
Get alerted when CVE-2007-6206 or the next vulnerability affects your stack