PT-2009-4024 · Linux · Linux Kernel

Eugene Teo · Published 2009-05-05 · Updated 2020-08-21 · CVE-2009-1527

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.30-rc4

Description: A race condition exists in the ptrace attach function, allowing local users to gain privileges. This issue is related to locking an incorrect cred exec mutex object and can be exploited via a PTRACE ATTACH ptrace call during an exec system call that is launching a setuid application.

Recommendations: For Linux kernel versions prior to 2.6.30-rc4, update to version 2.6.30-rc4 or later to resolve the issue.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2009-1527

Affected Products

Linux Kernel

References · 13

• 🔥 https://exploit-db.com/exploits/8673 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1527 · Security Note
• http://secunia.com/advisories/35120 · Note
• http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc4 · Note
• http://wiki.rpath.com/Advisories:rPSA-2009-0084 · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=cad81bc2529ab8c62b6fdc83a1c0c7f4a87209eb · Note
• http://vupen.com/english/advisories/2009/1236 · Note
• http://securityfocus.com/bid/34799 · Note
• http://openwall.com/lists/oss-security/2009/05/04/2 · Note
• http://secunia.com/advisories/34977 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50293 · Note
• http://osvdb.org/54188 · Note
• http://securityfocus.com/archive/1/503610/100/0/threaded · Note