// For flags

CVE-2007-1189

Plan 9 Kernel - 'devenv.c OTRUNC/pwrite' Local Privilege Escalation

Severity Score

7.2
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

4
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument, as demonstrated by (1) modifying the iseve function to gain privileges and (2) making the devpermcheck function grant unrestricted device permissions.

Desbordamiento de entero en la función envwrite en el kernel Alcatel-Lucent Bell Labs Plan 9 permite a un usuario local sobreescribir ciertas direcciones de memoria con la memoria kernel a través de un argumento n, como se demostró por (1) la modificación de la función iseve para ganar privilegios y (2)haciendo que la función devpermcheck conceda permisos sin restricción del dispositivo.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-03-02 CVE Reserved
  • 2007-03-02 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • 2024-09-11 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Bell Labs
Search vendor "Bell Labs"
Plan 9
Search vendor "Bell Labs" for product "Plan 9"
*-
Affected