CVE-2009-3286

kernel: O_EXCL creates on NFSv4 are broken

Severity Score

7.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails.

NFSv4 en el kernel de Linux versión 2.6.18, y posiblemente otras versiones, no limpia apropiadamente un inode cuando se produce un fallo de creación de O_EXCL, lo que causa que los archivos se creen con configuraciones no confiables, tales como bits setuid, y posiblemente permite a los usuarios locales alcanzar privilegios, relacionados con la ejecución de la función do_open_permission incluso cuando se produce un fallo en una creación.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-09-22 CVE Reserved
2009-09-22 CVE Published
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (14)

URL	Tag	Source
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=81ac95c5	X_refsource_confirm
http://lists.vmware.com/pipermail/security-announce/2010/000082.html	Mailing List
http://www.openwall.com/lists/oss-security/2009/09/21/2	Mailing List
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7527	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9757	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html	2023-11-07
http://secunia.com/advisories/37105	2023-11-07
http://secunia.com/advisories/38794	2023-11-07
http://secunia.com/advisories/38834	2023-11-07
http://www.ubuntu.com/usn/USN-852-1	2023-11-07
http://www.vupen.com/english/advisories/2010/0528	2023-11-07
https://bugzilla.redhat.com/show_bug.cgi?id=524520	2009-11-03
https://rhn.redhat.com/errata/RHSA-2009-1548.html	2023-11-07
https://access.redhat.com/security/cve/CVE-2009-3286	2009-11-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				2.6.18 Search vendor "Linux" for product "Linux Kernel" and version "2.6.18"		-		Affected