PT-2009-1110 · Linux · Linux Kernel

Eugene Teo · Published 2009-12-13 · Updated 2024-06-15 · CVE-2009-4131

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.32-git6

Description The issue is related to insufficient checks for file permissions in the EXT4 IOC MOVE EXT ioctl implementation in the ext4 filesystem. This allows local users to overwrite arbitrary files via a crafted request. The problem is associated with deficiencies in access control.

Recommendations For Linux kernel versions prior to 2.6.32-git6, update to version 2.6.32-git6 or later to resolve the issue. As a temporary workaround, consider restricting access to the EXT4 IOC MOVE EXT ioctl to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-02229

CVE-2009-4131

OPENSUSE-SU-2024:10128-1

Affected Products

Linux Kernel

References · 102

• 🔥 https://exploit-db.com/exploits/33395 · Exploit
• http://ubuntu.com/usn/USN-869-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10128-1 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2009-December/msg00702.html · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.32-git6.log · Patch
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:329 · Vendor Advisory
• http://secunia.com/advisories/37658 · Vendor Advisory
• http://lkml.org/lkml/2009/12/9/255 · Patch
• http://securityfocus.com/bid/37277 · Patch
• http://vupen.com/english/advisories/2009/3468 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=544471 · Patch
• https://bdu.fstec.ru/vul/2016-02229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-4131 · Security Note
• https://suse.com/security/cve/CVE-2016-3713 · Note