PT-2009-4391 · Freebsd · Freebsd

Pieter De Boer · Published 2009-06-18 · Updated 2017-08-17 · CVE-2009-1935

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: FreeBSD versions 6.3 through 6.4 FreeBSD versions 7.1 through 7.2

Description: The issue is related to an integer overflow in the pipe build write buffer function, which is part of the direct write optimization feature in the pipe implementation. This allows local users to bypass virtual-to-physical address lookups and potentially read sensitive information in memory pages.

Recommendations: For FreeBSD versions 6.3 through 6.4, update to a version that includes the fix for the integer overflow in the pipe build write buffer function. For FreeBSD versions 7.1 through 7.2, update to a version that includes the fix for the integer overflow in the pipe build write buffer function. As a temporary workaround, consider restricting access to the pipe implementation to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-1935

Affected Products

Freebsd

References · 8

• 🔥 http://security.freebsd.org/patches/SA-09:09/pipe.patch · Exploit
• http://secunia.com/advisories/35398 · Vendor Advisory
• http://security.freebsd.org/advisories/FreeBSD-SA-09:09.pipe.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1935 · Security Note
• http://securitytracker.com/id?1022365 · Note
• http://securityfocus.com/bid/35279 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51109 · Note
• http://osvdb.org/55044 · Note