PT-2009-3904 · Linux+1 · Linux Kernel+1

Eugene Teo · Published 2009-07-05 · Updated 2024-02-15 · CVE-2009-1388

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel version 2.6.18

Description The issue arises from the ptrace start function in kernel/ptrace.c, which does not properly handle simultaneous execution of the do coredump function. This allows local users to cause a denial of service (deadlock) via vectors involving the ptrace system call and a coredumping thread.

Recommendations For Linux kernel version 2.6.18, consider disabling the ptrace system call as a temporary workaround until a patch is available. Restrict access to the coredumping thread to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2009-1388

RHSA-2009:1193

RHSA-2009_1193

Affected Products

Linux Kernel

Red Hat

References · 113

• https://bdu.fstec.ru/vul/2015-05238 · Security Note
• https://bugzilla.redhat.com/attachment.cgi?id=346742 · Patch
• https://bdu.fstec.ru/vul/2015-04262 · Security Note
• https://bdu.fstec.ru/vul/2015-05231 · Security Note
• https://bdu.fstec.ru/vul/2015-05149 · Security Note
• https://bdu.fstec.ru/vul/2015-04247 · Security Note
• https://bdu.fstec.ru/vul/2015-05142 · Security Note
• https://bdu.fstec.ru/vul/2015-05145 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1193.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05228 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=504263 · Patch
• https://bdu.fstec.ru/vul/2015-05144 · Security Note
• https://bdu.fstec.ru/vul/2015-04266 · Security Note
• https://bdu.fstec.ru/vul/2015-05147 · Security Note
• https://bdu.fstec.ru/vul/2015-04261 · Security Note