Vulnerability in Linux Kernel
CVE-2006-4663
The source code tar archive of the Linux kernel 2.6.16, 2.6.17.11, and possibly other versions specifies weak permissions (0666 and 0777) for certain files and directories, which might allow local users to insert Trojan horse source code that would be used during the next kernel compilation. NOTE: another researcher disputes the vulnerability, stating that he finds "Not a single world-writable file or directory." CVE analysis as of 20060908 indicates that permissions will only be weak under certain unusual or insecure scenarios
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (23.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 24th percentile — 23.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Linux Kernel — versions 2.6.16, 2.6.17.11
References
- www.securityfocus.com/archive/1/445539/100/0/threaded (mailing-list)
- www.securityfocus.com/archive/1/445540/100/0/threaded (mailing-list)
Frequently asked questions
- What is CVE-2006-4663?
- CVE-2006-4663 is a high-severity vulnerability in Linux Kernel. CVSS score: 7.8/10. Published 2006-09-09.
- How severe is CVE-2006-4663?
- High severity. CVSS v3 base score is 7.8 out of 10.