PT-2009-1110 · Linux · Linux Kernel

Eugene Teo · Publicado 2009-12-13 · Atualizado 2024-06-15 · CVE-2009-4131

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.32-git6

Description The issue is related to insufficient checks for file permissions in the EXT4 IOC MOVE EXT ioctl implementation in the ext4 filesystem. This allows local users to overwrite arbitrary files via a crafted request. The problem is associated with deficiencies in access control.

Recommendations For Linux kernel versions prior to 2.6.32-git6, update to version 2.6.32-git6 or later to resolve the issue. As a temporary workaround, consider restricting access to the EXT4 IOC MOVE EXT ioctl to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-02229

CVE-2009-4131

OPENSUSE-SU-2024:10128-1

Produtos afetados

Linux Kernel

Referências · 102

• 🔥 https://exploit-db.com/exploits/33395 · Exploit
• https://suse.com/security/cve/CVE-2016-3713 · Nota
• https://suse.com/security/cve/CVE-2010-2066 · Nota
• http://ubuntu.com/usn/USN-869-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-7039 · Nota
• https://suse.com/security/cve/CVE-2016-2186 · Nota
• https://suse.com/security/cve/CVE-2016-4470 · Nota
• https://suse.com/security/cve/CVE-2011-0712 · Nota
• https://suse.com/security/cve/CVE-2016-2184 · Nota
• https://suse.com/security/cve/CVE-2010-3297 · Nota
• https://suse.com/security/cve/CVE-2010-3296 · Nota
• https://suse.com/security/cve/CVE-2013-0231 · Nota
• http://theregister.co.uk/2009/12/11/linux_kernel_bugs_patched · Nota
• https://suse.com/security/cve/CVE-2016-3136 · Nota
• https://suse.com/security/cve/CVE-2011-1577 · Nota