CVE-2009-1895

kernel: personality: fix PER_CLEAR_ON_SETID

Severity Score

7.2

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).

El subsistema de personalidad en el Linux kernel anterior a v2.6.31-rc3 tiene establecido que PER_CLEAR_ON_SETID no borre las banderas ADDR_COMPAT_LAYOUT y MMAP_PAGE_ZERO cuando ejecuta un programa setuid o setgid, lo que facilita a usuarios locales aprovechar los detalles del uso actual de memoria para (1) llevar a cabo ataques de deferencia a punteros NULOS, (2) evitar el mecanismo de protección mmap_min_addr o (3) rechazar aleatoriamente el espacio en la capa de direcciones (ASLR).

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-06-02 CVE Reserved
2009-07-16 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-16: Configuration

CAPEC

References (37)

URL	Tag	Source
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6	X_refsource_confirm
http://secunia.com/advisories/35801	Third Party Advisory
http://secunia.com/advisories/36045	Third Party Advisory
http://secunia.com/advisories/36051	Third Party Advisory
http://secunia.com/advisories/36054	Third Party Advisory
http://secunia.com/advisories/36116	Third Party Advisory
http://secunia.com/advisories/36131	Third Party Advisory
http://secunia.com/advisories/36759	Third Party Advisory
http://secunia.com/advisories/37471	Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0111	Third Party Advisory
http://www.osvdb.org/55807	Broken Link
http://www.securityfocus.com/archive/1/505254/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/507985/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/512019/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/35647	Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2009-0016.html	Third Party Advisory
http://www.vupen.com/english/advisories/2009/3316	Third Party Advisory
https://bugs.launchpad.net/bugs/cve/2009-1895	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11768	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7826	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9453	Signature

URL	Date	SRC

URL	Date	SRC
http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html	2023-02-13
http://patchwork.kernel.org/patch/32598	2023-02-13
http://www.vupen.com/english/advisories/2009/1866	2023-02-13

URL	Date	SRC
http://www.debian.org/security/2009/dsa-1844	2023-02-13
http://www.debian.org/security/2009/dsa-1845	2023-02-13
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc3	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2011:051	2023-02-13
http://www.redhat.com/support/errata/RHSA-2009-1193.html	2023-02-13
http://www.redhat.com/support/errata/RHSA-2009-1438.html	2023-02-13
http://www.ubuntu.com/usn/usn-807-1	2023-02-13
https://rhn.redhat.com/errata/RHSA-2009-1540.html	2023-02-13
https://rhn.redhat.com/errata/RHSA-2009-1550.html	2023-02-13
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00166.html	2023-02-13
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00223.html	2023-02-13
https://access.redhat.com/security/cve/CVE-2009-1895	2010-02-02
https://bugzilla.redhat.com/show_bug.cgi?id=511171	2010-02-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				<= 2.6.31 Search vendor "Linux" for product "Linux Kernel" and version " <= 2.6.31"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				2.6.31 Search vendor "Linux" for product "Linux Kernel" and version "2.6.31"		rc1		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				2.6.31 Search vendor "Linux" for product "Linux Kernel" and version "2.6.31"		rc2		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				5.0 Search vendor "Debian" for product "Debian Linux" and version "5.0"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				6.06 Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				8.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				8.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "8.10"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				9.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "9.04"		-		Affected