CVE-2009-1072

kernel: nfsd should drop CAP_MKNOD for non-root

Severity Score

4.9

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

nfsd en el Kernel de Linux anteriores a la v2.6.28.9 no detiene la capacidad de CAP_MKNOD antes del manejo de una petición de usuario en un hilo, lo que permite a usuarios locales crear nodos de dispositivo, como se ha demostrado en un sistema de ficheros que ha sido exportado con la opción root_squash.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Complete

Availability

None

Attack Vector

Local

Attack Complexity

High

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-03-24 CVE Reserved
2009-03-25 CVE Published
2024-08-07 CVE Updated
2024-11-08 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-16: Configuration

CAPEC

References (31)

URL	Tag	Source
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=76a67ec6fb79ff3570dcb5342142c16098299911	X_refsource_confirm
http://secunia.com/advisories/34422	Broken Link
http://secunia.com/advisories/34432	Broken Link
http://secunia.com/advisories/34786	Broken Link
http://secunia.com/advisories/35121	Broken Link
http://secunia.com/advisories/35185	Broken Link
http://secunia.com/advisories/35343	Broken Link
http://secunia.com/advisories/35390	Broken Link
http://secunia.com/advisories/35394	Broken Link
http://secunia.com/advisories/35656	Broken Link
http://secunia.com/advisories/37471	Broken Link
http://thread.gmane.org/gmane.linux.kernel/805280	Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.9	Broken Link
http://www.openwall.com/lists/oss-security/2009/03/23/1	Mailing List
http://www.securityfocus.com/archive/1/507985/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/34205	Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2009-0016.html	Third Party Advisory
http://www.vupen.com/english/advisories/2009/0802	Broken Link
http://www.vupen.com/english/advisories/2009/3316	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/49356	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10314	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8382	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html	2023-11-07
http://www.debian.org/security/2009/dsa-1800	2023-11-07
http://www.redhat.com/support/errata/RHSA-2009-1081.html	2023-11-07
http://www.ubuntu.com/usn/usn-793-1	2023-11-07
https://access.redhat.com/security/cve/CVE-2009-1072	2009-06-30
https://bugzilla.redhat.com/show_bug.cgi?id=491572	2009-06-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Vmware Search vendor "Vmware"	Vcenter Server Search vendor "Vmware" for product "Vcenter Server"	4.0 Search vendor "Vmware" for product "Vcenter Server" and version "4.0"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Vmware Search vendor "Vmware"	Virtualcenter Search vendor "Vmware" for product "Virtualcenter"	2.0.2 Search vendor "Vmware" for product "Virtualcenter" and version "2.0.2"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Vmware Search vendor "Vmware"	Virtualcenter Search vendor "Vmware" for product "Virtualcenter"	2.5 Search vendor "Vmware" for product "Virtualcenter" and version "2.5"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Vmware Search vendor "Vmware"	Vma Search vendor "Vmware" for product "Vma"	4.0 Search vendor "Vmware" for product "Vma" and version "4.0"	-	Affected	in	Redhat Search vendor "Redhat"	Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"	5.0 Search vendor "Redhat" for product "Enterprise Linux" and version "5.0"	-	Safe
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 2.6.28.9 Search vendor "Linux" for product "Linux Kernel" and version " < 2.6.28.9"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				10.3 Search vendor "Opensuse" for product "Opensuse" and version "10.3"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				11.0 Search vendor "Opensuse" for product "Opensuse" and version "11.0"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				11.1 Search vendor "Opensuse" for product "Opensuse" and version "11.1"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Desktop Search vendor "Suse" for product "Linux Enterprise Desktop"				10 Search vendor "Suse" for product "Linux Enterprise Desktop" and version "10"		sp2		Affected
Suse Search vendor "Suse"		Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server"				10 Search vendor "Suse" for product "Linux Enterprise Server" and version "10"		sp2		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				5.0 Search vendor "Debian" for product "Debian Linux" and version "5.0"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				6.06 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				8.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				8.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "8.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				9.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "9.04"		-		Affected
Vmware Search vendor "Vmware"		Server Search vendor "Vmware" for product "Server"				2.0.0 Search vendor "Vmware" for product "Server" and version "2.0.0"		-		Affected
Vmware Search vendor "Vmware"		Esx Search vendor "Vmware" for product "Esx"				3.0.3 Search vendor "Vmware" for product "Esx" and version "3.0.3"		-		Affected
Vmware Search vendor "Vmware"		Esx Search vendor "Vmware" for product "Esx"				3.5 Search vendor "Vmware" for product "Esx" and version "3.5"		-		Affected
Vmware Search vendor "Vmware"		Esx Search vendor "Vmware" for product "Esx"				4.0 Search vendor "Vmware" for product "Esx" and version "4.0"		-		Affected