CVE-2007-3723

The process scheduler in the Sun Solaris kernel does not make use of the process statistics kept by the kernel and performs scheduling based upon CPU billing gathered from periodic process sampling ticks, which allows local users to cause a denial of service (CPU consumption), as described in "Secretly Monopolizing the CPU Without Superuser Privileges."

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://osvdb.org/36616
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf
http://osvdb.org/36616
http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf

Configurations

Configuration 1 (hide)

cpe:2.3:o:sun:solaris:*:*:*:*:*:*:*:*

History

21 Nov 2024, 00:33

Type	Values Removed	Values Added
References	~~() http://osvdb.org/36616 -~~	() http://osvdb.org/36616 -
References	~~() http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf -~~	() http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf -

Information

Published : 2007-07-12 16:30

Updated : 2024-11-21 00:33

NVD link : CVE-2007-3723

Mitre link : CVE-2007-3723

CVE.ORG link : CVE-2007-3723

JSON object : View

Products Affected

sun

solaris

CWE

NVD-CWE-Other

{"id": "CVE-2007-3723", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-07-12T16:30:00.000", "references": [{"url": "http://osvdb.org/36616", "source": "cve@mitre.org"}, {"url": "http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/36616", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.cs.huji.ac.il/~dants/papers/Cheat07Security.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The process scheduler in the Sun Solaris kernel does not make use of the process statistics kept by the kernel and performs scheduling based upon CPU billing gathered from periodic process sampling ticks, which allows local users to cause a denial of service (CPU consumption), as described in \"Secretly Monopolizing the CPU Without Superuser Privileges.\""}, {"lang": "es", "value": "El programador de procesos del n\u00facleo de Sun Solaris no hace uso de las estad\u00edsticas de procesos mantenidas por el n\u00facleo, realiza la programaci\u00f3n bas\u00e1ndose en \"facturaci\u00f3n\" (billing) de CPU recogida de muestreo peri\u00f3dico de procesos, y da preferencia a procesos \"interactivos\" que realizan esperas voluntarias (sleeps), lo cual permite a usuarios locales provocar una denegaci\u00f3n de servicio (agotamiento de CPU), como se ha descrito en \"Monopolizando Secretamente la CPU sin Privilegios de Superusuario\" (Secretly Monopolizing the CPU Without Superuser Privileges)."}], "lastModified": "2024-11-21T00:33:54.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:sun:solaris:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "469B74F2-4B89-42B8-8638-731E92D463B9"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}