CVE-2004-2731
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux...
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
Exploit likelihood
What each source reports
NVD Score used
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
- Record
CVE-2004-2731- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
- Record
CVE-2004-2731- Updated
- 2026-11-02
EUVDEUVD-2004-2721 No score
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
- Record
EUVD-2004-2721- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rg5q-w7qj-gw3c No score
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux...
Multiple integer overflows in Sbus PROM driver (drivers/sbus/char/openprom.c) for the Linux kernel 2.4.x up to 2.4.27, 2.6.x up to 2.6.7, and possibly later versions, allow local users to execute arbitrary code by specifying (1) a small buffer size to the copyin_string function or (2) a negative buffer size to the copyin function.
- Record
GHSA-rg5q-w7qj-gw3c- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kernel-latest-2.4-i386Debian:3.1 |
before 101sarge2, plus listed versions 101101sarge1 |
101sarge2 |
kernel-image-2.4.27-alphaDebian:3.1 |
before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 |
2.4.27-10sarge6 |
kernel-image-2.4.27-m68kDebian:3.1 |
before 2.4.27-3sarge6, plus listed versions 2.4.27-32.4.27-3sarge12.4.27-3sarge22.4.27-3sarge32.4.27-3sarge42.4.27-3sarge5 |
2.4.27-3sarge6 |
i2cDebian:3.1 |
before 1:2.9.1-1sarge2, plus listed versions 1:2.9.1-11:2.9.1-1sarge1 |
1:2.9.1-1sarge2 |
systemimagerDebian:3.1 |
before 3.2.3-6sarge5, plus listed versions 3.2.3-63.2.3-6sarge13.2.3-6sarge23.2.3-6sarge33.2.3-6sarge4 |
3.2.3-6sarge5 |
kernel-latest-2.4-alphaDebian:3.1 |
before 101sarge3, plus listed versions 101101sarge1 |
101sarge3 |
kernel-patch-powerpc-2.4.27Debian:3.1 |
before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 |
2.4.27-10sarge6 |
kernel-latest-2.4-sparcDebian:3.1 |
before 42sarge3, plus listed versions 4242sarge142sarge2 |
42sarge3 |
kernel-patch-2.4.27-mipsDebian:3.1 |
before 2.4.27-10.sarge4.040815-3, plus listed versions 2.4.27-10.040815-12.4.27-10.sarge1.040815-12.4.27-10.sarge2.040815-12.4.27-10.sarge3.040815-12.4.27-10.sarge4.040815-12.4.27-10.sarge4.040815-2 |
2.4.27-10.sarge4.040815-3 |
pcmcia-modules-2.4.27-i386Debian:3.1 |
before 3.2.5+2sarge2, plus listed versions 3.2.5+23.2.5+2sarge1 |
3.2.5+2sarge2 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-image-2.4.27-ia64Debian:3.1 |
before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 |
2.4.27-10sarge6 |
mindi-kernelDebian:3.1 |
before 2.4.27-2sarge5, plus listed versions 2.4.27-22.4.27-2sarge12.4.27-2sarge22.4.27-2sarge32.4.27-2sarge4 |
2.4.27-2sarge5 |
kernel-latest-2.4-s390Debian:3.1 |
before 2.4.27-1sarge2, plus listed versions 2.4.27-12.4.27-1sarge1 |
2.4.27-1sarge2 |
hostap-modules-i386Debian:3.1 |
before 1:0.3.7-1sarge3, plus listed versions 1:0.3.7-11:0.3.7-1sarge11:0.3.7-1sarge2 |
1:0.3.7-1sarge3 |
kernel-image-speakup-i386Debian:3.1 |
before 2.4.27-1.1sarge5, plus listed versions 2.4.27-1.12.4.27-1.1sarge12.4.27-1.1sarge22.4.27-1.1sarge32.4.27-1.1sarge4 |
2.4.27-1.1sarge5 |
kernel-source-2.4.27Debian:3.1 |
before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 |
2.4.27-10sarge6 |
kernel-image-2.4.27-armDebian:3.1 |
before 2.4.27-2sarge6, plus listed versions 2.4.27-22.4.27-2sarge12.4.27-2sarge22.4.27-2sarge32.4.27-2sarge42.4.27-2sarge5 |
2.4.27-2sarge6 |
kernel-image-2.4.27-i386Debian:3.1 |
before 2.4.27-10sarge6, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge5 |
2.4.27-10sarge6 |
kernel-image-2.4.27-sparcDebian:3.1 |
before 2.4.27-9sarge6, plus listed versions 2.4.27-92.4.27-9sarge12.4.27-9sarge22.4.27-9sarge32.4.27-9sarge42.4.27-9sarge5 |
2.4.27-9sarge6 |
kernel-image-2.4.27-s390Debian:3.1 |
before 2.4.27-2sarge6, plus listed versions 2.4.27-22.4.27-2sarge12.4.27-2sarge22.4.27-2sarge32.4.27-2sarge42.4.27-2sarge5 |
2.4.27-2sarge6 |
kernel-source-2.4.27Debian:3.1 |
before 2.4.27-10sarge7, plus listed versions 2.4.27-102.4.27-10sarge12.4.27-10sarge22.4.27-10sarge32.4.27-10sarge42.4.27-10sarge52.4.27-10sarge6 |
2.4.27-10sarge7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-2731 is a medium vulnerability (CVSS 4.4) in Linux Kernel, published December 31, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in kernel-latest-2.4-i386 101sarge2.