PT-2009-4984 · Linux · Linux Kernel

Michael Buesch · Published 2009-07-23 · Updated 2018-11-16 · CVE-2009-2584

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.30.2 on ia64 and x86 platforms

Description The issue is related to an off-by-one error in the options write function within the SGI GRU driver. This error can lead to a stack-based buffer overflow when a crafted count argument is provided, potentially allowing local users to overwrite arbitrary memory locations and gain privileges.

Recommendations For Linux kernel versions prior to 2.6.30.2 on ia64 and x86 platforms, consider upgrading to a version that addresses this issue to prevent potential exploitation. As a temporary workaround, restrict access to the SGI GRU driver to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2009-2584

Affected Products

Linux Kernel

References · 9

• 🔥 http://grsecurity.net/~spender/exploit_demo.c · Exploit
• 🔥 http://lkml.org/lkml/2009/7/20/348 · Exploit
• 🔥 http://xorl.wordpress.com/2009/07/21/linux-kernel-sgi-gru-driver-off-by-one-overwrite · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2584 · Security Note
• http://ubuntu.com/usn/USN-852-1 · Vendor Advisory
• http://securityfocus.com/bid/35753 · Note
• http://secunia.com/advisories/37105 · Note
• http://lkml.org/lkml/2009/7/20/362 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51887 · Note