CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 1CVE-2009-3238 – kernel: random: add robust get_random_u32, remove weak get_random_int
https://notcve.org/view.php?id=CVE-2009-3238
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time." La función get_random_int de drivers/char/random.c en el kernel de Linux anterior a v2.6.30, produce números que nos son suficientemente aleatorios, esto permite a los atacantes predecir el valor devuelto y permite que se puedan superar los mecanismos de protección basados en la aleatoriedad, a través de vectores que eleven la tendencia de la función a "devolver el mismo valor una y otra vez durante largos periodos de tiempo". • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8a0a9bd4db63bc45e3017bedeafbd88d0eb84d02 http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://patchwork.kernel.org/patch/21766 http://secunia.com/advisories/37105 http://secunia.com/advisories/37351 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30 http://www.redhat.com/support/errata/RHSA-2009& • CWE-330: Use of Insufficiently Random Values CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2009-1883 – kernel: missing capability check in z90crypt
https://notcve.org/view.php?id=CVE-2009-1883
The z90crypt_unlocked_ioctl function in the z90crypt driver in the Linux kernel 2.6.9 does not perform a capability check for the Z90QUIESCE operation, which allows local users to leverage euid 0 privileges to force a driver outage. La función z90crypt_unlocked_ioctl en el controlador z90crypt del kernel de Linux v2.6.9, no realiza una comprobaciónd e capacidad en la operación Z90QUIESCE, esto permite a usuarios locales elevar los privilegios euid 0 para forzar una parada en el controlador. • http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html http://secunia.com/advisories/36759 http://secunia.com/advisories/37105 http://www.openwall.com/lists/oss-security/2009/09/15/1 http://www.openwall.com/lists/oss-security/2009/09/15/3 http://www.redhat.com/support/errata/RHSA-2009-1438.html http://www.ubuntu.com/usn/USN-852-1 https://bugzilla.redhat.com/show_bug.cgi?id=505983 https://oval.cisecurity.org/repository/search/definition/oval%3Aor • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 2CVE-2009-3234 – Linux Kernel 2.6.31 - 'perf_counter_open()' Local Buffer Overflow
https://notcve.org/view.php?id=CVE-2009-3234
Buffer overflow in the perf_copy_attr function in kernel/perf_counter.c in the Linux kernel 2.6.31-rc1 allows local users to cause a denial of service (crash) and execute arbitrary code via a "big size data" to the perf_counter_open system call. Un desbordamiento de búfer en la función perf_copy_attr en el archivo kernel/perf_counter.c en el kernel de Linux versión 2.6.31-rc1, permite a los usuarios locales causar una denegación de servicio (bloqueo) y ejecutar código arbitrario por medio de un "big size data" en la llamada del sistema perf_counter_open. • https://www.exploit-db.com/exploits/33228 http://article.gmane.org/gmane.linux.kernel/890654 http://www.openwall.com/lists/oss-security/2009/09/16/1 http://www.openwall.com/lists/oss-security/2009/09/17/13 http://www.securityfocus.com/bid/36423 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.1EPSS: 2%CPEs: 15EXPL: 0CVE-2009-2903
https://notcve.org/view.php?id=CVE-2009-2903
Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams. Fuga de memoria en el subsistema appletalk en el Kernel de Linux v2.4.x hasta v2.4.37.6 y v2.6.x hasta v2.6.31, cuando los módulos appletalk y ipddp están cargados pero el dispositivo ipddp"N" no se encuentra, permite a atacantes remotos provocar una denegación de servicio (consumo de memoria) a través de datagramas IP-DDP. • http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git%3Ba=commit%3Bh=ffcfb8db540ff879c2a85bf7e404954281443414 http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html http://secunia.com/advisories/36707 http://secunia.com/advisories/37105 http://sec • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 4.9EPSS: 0%CPEs: 316EXPL: 4CVE-2009-3043 – Linux Kernel 2.6.x - 'drivers/char/tty_ldisc.c' Null Pointer Dereference Denial of Service
https://notcve.org/view.php?id=CVE-2009-3043
The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a denial of service (system crash, sometimes preceded by a NULL pointer dereference) or possibly gain privileges via certain pseudo-terminal I/O activity, as demonstrated by KernelTtyTest.c. La función tty_ldisc_hangup en el archivo drivers/char/tty_ldisc.c en el kernel de Linux versiones 2.6.31-rc anteriores a 2.6.31-rc8, permite a los usuarios locales causar una denegación de servicio (bloqueo de sistema, a veces precedido por una desreferencia de puntero NULL) o posiblemente alcanzar privilegios por medio de cierta actividad de I/O pseudoterminal, como es demostrado por el archivo KernelTtyTest.c. • https://www.exploit-db.com/exploits/33193 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5c58ceff103d8a654f24769bb1baaf84a841b0cc http://lkml.org/lkml/2009/8/20/21 http://lkml.org/lkml/2009/8/20/27 http://lkml.org/lkml/2009/8/20/68 http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc8 http://www.openwall.com/lists/oss-security/2009/08/31/1 http://www.openwall.com/lists/oss-security/2009/09/ • CWE-399: Resource Management Errors •