PT-2009-4024 · Linux · Linux Kernel

Eugene Teo · Publicado 2009-05-05 · Atualizado 2020-08-21 · CVE-2009-1527

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.30-rc4

Description: A race condition exists in the ptrace attach function, allowing local users to gain privileges. This issue is related to locking an incorrect cred exec mutex object and can be exploited via a PTRACE ATTACH ptrace call during an exec system call that is launching a setuid application.

Recommendations: For Linux kernel versions prior to 2.6.30-rc4, update to version 2.6.30-rc4 or later to resolve the issue.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2009-1527

Produtos afetados

Linux Kernel

Referências · 13

• 🔥 https://exploit-db.com/exploits/8673 · Exploit
• http://secunia.com/advisories/35120 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-1527 · Nota de Segurança
• http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc4 · Nota
• http://wiki.rpath.com/Advisories:rPSA-2009-0084 · Nota
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=cad81bc2529ab8c62b6fdc83a1c0c7f4a87209eb · Nota
• http://vupen.com/english/advisories/2009/1236 · Nota
• http://securityfocus.com/bid/34799 · Nota
• http://openwall.com/lists/oss-security/2009/05/04/2 · Nota
• http://secunia.com/advisories/34977 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50293 · Nota
• http://osvdb.org/54188 · Nota
• http://securityfocus.com/archive/1/503610/100/0/threaded · Nota