PT-2009-6198 · Linux · Linux Kernel

Published 2009-11-20 · Updated 2020-08-12 · CVE-2009-4004

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.32-rc7

Description The issue is related to a buffer overflow in the kvm vcpu ioctl x86 setup mce function, which can cause memory corruption or potentially allow local users to gain privileges. This is achieved by sending a KVM X86 SETUP MCE IOCTL request with a large number of Machine Check Exception (MCE) banks.

Recommendations For Linux kernel versions prior to 2.6.32-rc7, update to version 2.6.32-rc7 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-4004

Affected Products

Linux Kernel

References · 7

• http://secunia.com/advisories/37357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4004 · Security Note
• http://vupen.com/english/advisories/2009/3267 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54302 · Note
• http://securityfocus.com/bid/37035 · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a9e38c3e01ad242fe2a625354cf065c34b01e3aa · Note
• http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc7 · Note