CVE-2004-0077
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6...
7.2 HighPublic exploitFix available
CVE-2004-0077 is a high vulnerability (CVSS 7.2) in Netwosix Linux, published February 18, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.45%, the 84th percentile. Fixed in kernel-source-2.4.18 2.4.18-14.2.
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
Exploit likelihood
2.45%Down 1.6 points since Feb 4, 2022
What each source reports
NVD Score used
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
- Record
CVE-2004-0077- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
- Record
CVE-2004-0077- Updated
- 2026-11-02
EUVDEUVD-2004-0077 No score
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
- Record
EUVD-2004-0077- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pm7j-3492-hq9m No score
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6...
The do_mremap function for the mremap system call in Linux 2.2 to 2.2.25, 2.4 to 2.4.24, and 2.6 to 2.6.2, does not properly check the return value from the do_munmap function when the maximum number of VMA descriptors is exceeded, which allows local users to gain root privileges, a different vulnerability than CAN-2003-0985.
- Record
GHSA-pm7j-3492-hq9m- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kernel-source-2.4.18Debian:3.0 |
before 2.4.18-14.2 | 2.4.18-14.2 |
kernel-image-2.4.18-1-alphaDebian:3.0 |
before 2.4.18-14 | 2.4.18-14 |
kernel-image-2.4.18-1-i386Debian:3.0 |
before 2.4.18-12.2 | 2.4.18-12.2 |
kernel-image-2.4.18-i386bfDebian:3.0 |
before 2.4.18-5woody7, plus listed versions 2.4.18-5 |
2.4.18-5woody7 |
kernel-patch-2.4.18-powerpcDebian:3.0 |
before 2.4.18-1woody4 | 2.4.18-1woody4 |
kernel-image-2.4.16-lartDebian:3.0 |
before 2.4.16-20040204 | 2.4.16-20040204 |
kernel-image-2.4.16-netwinderDebian:3.0 |
before 2.4.16-20040204 | 2.4.16-20040204 |
kernel-image-2.4.16-riscpcDebian:3.0 |
before 2.4.16-20040204 | 2.4.16-20040204 |
kernel-patch-2.4.16-armDebian:3.0 |
before 20040204 | 20040204 |
kernel-source-2.4.17Debian:3.0 |
before 2.4.17-4, plus listed versions 2.4.17-1woody32.4.17-1woody4 |
2.4.17-4 |
Show 69 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-patch-2.4.17-apusDebian:3.0 |
before 2.4.17-4 | 2.4.17-4 |
kernel-patch-2.4.17-mipsDebian:3.0 |
before 2.4.17-0.020226.2.woody5 | 2.4.17-0.020226.2.woody5 |
kernel-patch-2.4.17-s390Debian:3.0 |
before 0.0.20020816-0.woody.2 | 0.0.20020816-0.woody.2 |
kernel-image-2.4.17-s390Debian:3.0 |
before 2.4.17-2.woody.3 | 2.4.17-2.woody.3 |
kernel-image-2.4.17-ia64Debian:3.0 |
before 011226.16 | 011226.16 |
kernel-source-2.4.19Debian:3.0 |
before 2.4.19-0.020911.1.woody3 | 2.4.19-0.020911.1.woody3 |
kernel-patch-2.4.19-mipsDebian:3.0 |
before 2.4.19-4.woody1, plus listed versions 2.4.19-0.020911.1.woody42.4.19-0.020911.1.woody5 |
2.4.19-4.woody1 |
kernel-source-2.2.20Debian:3.0 |
before 2.2.20-5woody3 | 2.2.20-5woody3 |
kernel-image-2.2.20-i386Debian:3.0 |
before 2.2.20-5woody5 | 2.2.20-5woody5 |
kernel-image-2.2.20-reiserfs-i386Debian:3.0 |
before 2.2.20-4woody1, plus listed versions 2.2.20-4 |
2.2.20-4woody1 |
kernel-image-2.2.20-amigaDebian:3.0 |
before 2.20-4, plus listed versions 2.2.20-4 |
2.20-4 |
kernel-image-2.2.20-atariDebian:3.0 |
before 2.2.20-3 | 2.2.20-3 |
kernel-image-2.2.20-bvme6000Debian:3.0 |
before 2.2.20-3 | 2.2.20-3 |
kernel-image-2.2.20-macDebian:3.0 |
before 2.2.20-3 | 2.2.20-3 |
kernel-image-2.2.20-mvme147Debian:3.0 |
before 2.2.20-3 | 2.2.20-3 |
kernel-image-2.2.20-mvme16xDebian:3.0 |
before 2.2.20-3 | 2.2.20-3 |
kernel-patch-2.2.20-powerpcDebian:3.0 |
before 2.2.20-3woody1 | 2.2.20-3woody1 |
kernel-source-2.2.22Debian:3.0 |
before 2.2.22-1woody1 | 2.2.22-1woody1 |
kernel-image-2.2.22-alphaDebian:3.0 |
before 2.2.22-2 | 2.2.22-2 |
kernel-source-2.2.19Debian:3.0 |
before 2.2.19.1-4woody1 | 2.2.19.1-4woody1 |
kernel-patch-2.2.19-armDebian:3.0 |
before 20040303 | 20040303 |
kernel-image-2.2.19-netwinderDebian:3.0 |
before 20040303 | 20040303 |
kernel-image-2.2.19-riscpcDebian:3.0 |
before 20040303 | 20040303 |
kernel-source-2.2.10Debian:3.0 |
before 2.2.10-2 | 2.2.10-2 |
kernel-image-2.2.10-powerpc-apusDebian:3.0 |
before 2.2.10-13woody1, plus listed versions 2.2.10-13 |
2.2.10-13woody1 |
kernel-image-2.4.17-hppaDebian:3.0 |
before 32.3 | 32.3 |
kernel-image-2.4.18-hppaDebian:3.0 |
before 62.1 | 62.1 |
kernelRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::as |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
s390utilsRed Hat:enterprise_linux:3::as |
before 2:1.2.4-3 | 2:1.2.4-3 |
s390utils-debuginfoRed Hat:enterprise_linux:3::as |
before 2:1.2.4-3 | 2:1.2.4-3 |
kernelRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::desktop |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernelRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::es |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernelRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-BOOTRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-docRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugememRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-hugemem-unsupportedRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smpRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-smp-unsupportedRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-sourceRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
kernel-unsupportedRed Hat:enterprise_linux:3::ws |
before 0:2.4.21-9.0.1.EL | 0:2.4.21-9.0.1.EL |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Validator | 2004-02-18 |
| Exploit-DB | Linux Kernel 2.2.25/2.4.24/2.6.2 - 'mremap()' Local Privilege Escalation | 2004-03-01 |
| PoC in GitHub | 0b0111100/2004 | 2026-09-07 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
slackware.com/security/viewer.php?l=slackware-security&y=2004&m=slackware-security.404734
debian.org/security/2004/dsa-450
redhat.com/support/errata/RHSA-2004-069.html
ciac.org/ciac/bulletins/o-082.shtml
fedoranews.org/updates/FEDORA-2004-079.shtml
Show 44 moreShow less
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000820
novell.com/linux/security/advisories/2004_05_linux_kernel.html
frontal2.mandriva.com/security/advisories?name=MDKSA-2004:015
securityfocus.com/bid/9686
isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A837
security.gentoo.org/glsa/glsa-200403-02.xml
archives.neohapsis.com/archives/vulnwatch/2004-q1/0040.html
exchange.xforce.ibmcloud.com/vulnerabilities/15244
marc.info?l=bugtraq&m=107711762014175&w=2
osvdb.org/3986
kb.cert.org/vuls/id/981222
nvd.nist.gov/vuln/detail/CVE-2004-0077
github.com/advisories/GHSA-pm7j-3492-hq9m
access.redhat.com/errata/RHSA-2004:066
www10.software.ibm.com/developerworks/opensource/linux390/s390-tools-1.2.4-june2003.shtml
bugzilla.redhat.com/show_bug.cgi?id=112891
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_066.json
cve.org/CVERecord?id=CVE-2004-0077