CVE-2007-2172: canonical ubuntu_linux Improper Input Validation

Modified

Published 22-04-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-2172 is a medium (CVSS 4.7) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 37.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.7/10

010

Medium · v2.0 (NVD)

EPSS score

0.43%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10

DSA-1356-1 DSA-1363-1 DSA-1503-1 DSA-1503-2 DSA-1504-1 RHSA-2007:0347+4 more

Timeline

22-04-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

A typo in Linux kernel 2.6 before 2.6.21-rc6 and 2.4 before 2.4.35 causes RTA_MAX to be used as an array size instead of RTN_MAX, which leads to an "out of bound access" by the (1) dn_fib_props (dn_fib.c, DECNet) and (2) fib_props (fib_semantics.c, IPv4) functions.

CVSS metrics

1 score · 1 source · 1 version

v2.04.7

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.

Canonical1 product

ubuntu_linuxEOL6.06 | 6.10 | 7.04

Debian1 product

debian_linuxEOL3.1 | 4.0

Linux1 product

linux_kernel≥ 2.4.0, < 2.4.35 | ≥ 2.6.0, ≤ 2.6.20 | 2.6.21:git1 | 2.6.21:git2 | 2.6.21:git3 | 2.6.21:git4 | 2.6.21:git5 | 2.6.21:git6 | 2.6.21:git7 | 2.6.21:rc1 | 2.6.21:rc2 | 2.6.21:rc3 | 2.6.21:rc4 | 2.6.21:rc5

3 vendors · 3 products

References

32 links

www.redhat.com/support/errata/RHSA-2007-0347.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.ubuntu.com/usn/usn-464-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.redhat.com/support/errata/RHSA-2007-1049.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/27913Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2007/dsa-1363Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/26289Third Party AdvisoryX Refsource SECUNIA
www.mail-archive.com/git-commits-head%40vger.kernel.org/msg08270.htmlX Refsource CONFIRM
secunia.com/advisories/25838Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:171Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
www.debian.org/security/2008/dsa-1504Vendor AdvisoryX Refsource DEBIANThird Party Advisory

Show all 32 references

www.debian.org/security/2007/dsa-1356Vendor AdvisoryX Refsource DEBIANThird Party Advisory
secunia.com/advisories/26647Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:216Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10764VDB EntrySignatureX Refsource OVALThird Party Advisory
www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.35X Refsource CONFIRMVendor Advisory
secunia.com/advisories/33280Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/25288Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/26620Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/33979VDB EntryX Refsource XFThird Party Advisory
www.mandriva.com/security/advisories?name=MDKSA-2007:196Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
secunia.com/advisories/25068Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1503Vendor AdvisoryX Refsource DEBIANThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2007-287.htmX Refsource CONFIRMThird Party Advisory
secunia.com/advisories/25392Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29058Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2008-0787.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/26450Third Party AdvisoryX Refsource SECUNIA
kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.21-rc6X Refsource CONFIRMVendor Advisory
www.securityfocus.com/bid/23447VDB EntryX Refsource BIDPatchThird Party AdvisoryVendor Advisory
www.vupen.com/english/advisories/2007/2690VDB EntryX Refsource VUPENThird Party Advisory
rhn.redhat.com/errata/RHSA-2007-0488.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.mail-archive.com/git-commits-head%40vger.kernel.org/msg08269.htmlX Refsource CONFIRM