PT-2009-4984 · Linux · Linux Kernel

Michael Buesch · Publicado 2009-07-23 · Atualizado 2018-11-16 · CVE-2009-2584

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.30.2 on ia64 and x86 platforms

Description The issue is related to an off-by-one error in the options write function within the SGI GRU driver. This error can lead to a stack-based buffer overflow when a crafted count argument is provided, potentially allowing local users to overwrite arbitrary memory locations and gain privileges.

Recommendations For Linux kernel versions prior to 2.6.30.2 on ia64 and x86 platforms, consider upgrading to a version that addresses this issue to prevent potential exploitation. As a temporary workaround, restrict access to the SGI GRU driver to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2009-2584

Produtos afetados

Linux Kernel

Referências · 9

• 🔥 http://grsecurity.net/~spender/exploit_demo.c · Exploit
• 🔥 http://lkml.org/lkml/2009/7/20/348 · Exploit
• 🔥 http://xorl.wordpress.com/2009/07/21/linux-kernel-sgi-gru-driver-off-by-one-overwrite · Exploit
• http://securityfocus.com/bid/35753 · Nota
• http://secunia.com/advisories/37105 · Nota
• http://lkml.org/lkml/2009/7/20/362 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2584 · Nota de Segurança
• http://ubuntu.com/usn/USN-852-1 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51887 · Nota