PT-2009-6198 · Linux · Linux Kernel

Publicado 2009-11-20 · Atualizado 2020-08-12 · CVE-2009-4004

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.32-rc7

Description The issue is related to a buffer overflow in the kvm vcpu ioctl x86 setup mce function, which can cause memory corruption or potentially allow local users to gain privileges. This is achieved by sending a KVM X86 SETUP MCE IOCTL request with a large number of Machine Check Exception (MCE) banks.

Recommendations For Linux kernel versions prior to 2.6.32-rc7, update to version 2.6.32-rc7 or later to resolve the issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-4004

Produtos afetados

Linux Kernel

Referências · 7

• http://vupen.com/english/advisories/2009/3267 · Nota
• http://secunia.com/advisories/37357 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-4004 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54302 · Nota
• http://securityfocus.com/bid/37035 · Nota
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a9e38c3e01ad242fe2a625354cf065c34b01e3aa · Nota
• http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc7 · Nota