CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 3CVE-2009-2584
https://notcve.org/view.php?id=CVE-2009-2584
Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow. Error de superación de límite (Off-by-one) en la función drivers/misc/sgi-gru/gruprocfs.c en el controlador SGI GRU en el kernel de Linux v2.6.30.2 y anteriores en plataformas ia64 y x86 pueden permitir a usuarios locales escribir posiciones de memoria a su elección y obtener privilegios a través de argumentos de cuenta manipulados, provocando un desbordamiento de búfer basado en pila. • http://grsecurity.net/~spender/exploit_demo.c http://lkml.org/lkml/2009/7/20/348 http://lkml.org/lkml/2009/7/20/362 http://secunia.com/advisories/37105 http://www.securityfocus.com/bid/35753 http://www.ubuntu.com/usn/USN-852-1 http://xorl.wordpress.com/2009/07/21/linux-kernel-sgi-gru-driver-off-by-one-overwrite https://exchange.xforce.ibmcloud.com/vulnerabilities/51887 • CWE-189: Numeric Errors •
CVSS: 6.9EPSS: 0%CPEs: 9EXPL: 4CVE-2009-1897 – Linux Kernel 2.6.30 - 'tun_chr_pool()' Null Pointer Dereference
https://notcve.org/view.php?id=CVE-2009-1897
The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894. La función tun_chr_poll en drivers/net/tun.c en el subsistema tun del kernel de Linux v2.6.30 y v2.6.30.1, cuando se omite la opción -fno-delete-null-pointer-checks en gcc, permite a atacantes locales obtener privilegios a través de vectores que implican desreferenciacion de punteros NULL y un nmap de /dev/net/tun, es una vulnerabilidad diferente a CVE-2009-1894. • https://www.exploit-db.com/exploits/33088 https://www.exploit-db.com/exploits/9191 http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html http://article.gmane.org/gmane.linux.network/124939 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13 http://grsecurity.net/~spender/cheddar_bay.tgz http://isc.sans.org/diary.html?storyid=6820 ht • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.2EPSS: 0%CPEs: 9EXPL: 0CVE-2009-1895 – kernel: personality: fix PER_CLEAR_ON_SETID
https://notcve.org/view.php?id=CVE-2009-1895
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR). El subsistema de personalidad en el Linux kernel anterior a v2.6.31-rc3 tiene establecido que PER_CLEAR_ON_SETID no borre las banderas ADDR_COMPAT_LAYOUT y MMAP_PAGE_ZERO cuando ejecuta un programa setuid o setgid, lo que facilita a usuarios locales aprovechar los detalles del uso actual de memoria para (1) llevar a cabo ataques de deferencia a punteros NULOS, (2) evitar el mecanismo de protección mmap_min_addr o (3) rechazar aleatoriamente el espacio en la capa de direcciones (ASLR). • http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6 http://patchwork.kernel.org/patch/32598 http://secunia.com/advisories/35801 http://secunia.com/advisories/36045 http://secunia.com/advisories/36051 http://secunia.com/advisories/36054 http://secunia.com/advisories/36116 http://secunia.com/advisories/36131 http://secunia.com/advisories/36759 http:// • CWE-16: Configuration •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-1388 – kernel: do_coredump() vs ptrace_start() deadlock
https://notcve.org/view.php?id=CVE-2009-1388
The ptrace_start function in kernel/ptrace.c in the Linux kernel 2.6.18 does not properly handle simultaneous execution of the do_coredump function, which allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping thread. La función ptrace_start de kernel/ptrace.c en el kernel de Linux v2.6.18, no maneja adecuadamente la ejecución simultánea de la función do_coredump, esto permite a usuarios locales provocar una denegación de servicio -bloqueo mutuo (deadlock)- a través de vectores que incluyen la llamada al sistema ptrace y un hilo coredumping. • http://marc.info/?l=oss-security&m=124654277229434&w=2 http://osvdb.org/55679 http://secunia.com/advisories/36131 http://secunia.com/advisories/37471 http://www.redhat.com/support/errata/RHSA-2009-1193.html http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.securityfocus.com/bid/35559 http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/3316 https://bugzilla.redhat.com/attachment.cgi?id=346615 • CWE-667: Improper Locking •
CVSS: 4.9EPSS: 0%CPEs: 7EXPL: 0CVE-2009-2287
https://notcve.org/view.php?id=CVE-2009-2287
The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function. La funciónkvm_arch_vcpu_ioctl_set_sregs en el KVM en el Kernel Linux v2.6 anterior a v2.6.30, ejecutado sobre plataformas x86, no valida la "page table root" (raíz de tabla de páginas) en una llamada KVM_SET_SREGS, lo que permite a usuarios locales provocar una denegación de servicio (cuelgue o caída) a través de un valor cr3 manipulado, lo que lanza un deferencia a puntero NULL en la función gfn_to_rmap. • http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git%3Ba=blob%3Bf=queue-2.6.30/kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch%3Bh=b48a47dad2cf76358b327368f80c0805e6370c68%3Bhb=e7c45b24f298b5d9efd7d401150f64a1b51aaac4 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=59839dfff5eabca01cc4e20b45797a60a80af8cb http://secunia.com/advisories/35675 http://secunia.com/advisories/36045 http://secunia.com/advisories/36054 http://sourceforge.net/tracker/?func=detail&atid& • CWE-476: NULL Pointer Dereference •