About Us | Contact Us

 


 

VUPEN Free Resources

 
  VUPEN Security Advisories
 
  VUPEN Security Blog & News
  Zero-day Attacks Monitor
  Daily Security Mailinglist
  Explanation of Terms
  Advanced Search Engine
 
   

Linux Kernel Privilege Escalation and Integer Overflow Vulnerabilities

VUPEN ID VUPEN/ADV-2009-0975
CVE ID CVE-2009-1265 - CVE-2009-1337
 
CWE ID Available in VUPEN VNS Customer Area
CVSS V2 Available in VUPEN VNS Customer Area
Rated as Moderate Risk 
Impact Available in VUPEN VNS Customer Area
Authentication Level Available in VUPEN VNS Customer Area
Access Vector Available in VUPEN VNS Customer Area
Release Date 2009-04-09
Share Twitter LinkedIn Facebook Delicious Digg Slashdot

Technical Description

Multiple vulnerabilities have been identified in Linux Kernel, which could be exploited by local attackers to bypass security restrictions, disclose sensitive information, or gain elevated privileges.

The first issue is caused by an error in the "exit_notify()" [kernel/exit.c] function that does not properly check the CAP_KILL capability, which could allow malicious users to bypass security checks and gain elevated privileges by executing a setuid application before exiting.

The second vulnerability is caused by integer overflow errors in the "rose_sendmsg()" [sys/net/af_rose.c], "nr_sendmsg()" [net/netrom/af_netrom.c], and "x25_sendmsg()" [net/x25/af_x25.c] functions, which could be exploited by malicious users to disclose certain information.

Affected Products

Linux Kernel versions prior to 2.6.30-rc1

Solution 

Upgrade to Linux Kernel version 2.6.30-rc1 :
http://www.kernel.org/

References

http://www.vupen.com/english/advisories/2009/0975
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=432870dab85a2f69dc417022646cb9a70acf7f94
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=83e0bbcbe2145f160fbaa109b0439dae7f4a38a9
http://bugzilla.kernel.org/show_bug.cgi?id=10423
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc1

Credits 

Vulnerabilities reported by Oleg Nesterov and Thomas Pollet.

Changelog 

2009-04-09 : Initial release

Feedback 

If you have additional information or corrections for this security advisory please submit them via our contact form.

 

Monthly Statistics 

 

 VUPEN Security Advisories By Criticality: Aug 2010


  Critical Risk

: 0%

  High Risk
: 0%

  Moderate Risk
: 0%

  Low Risk
: 100%

Get a real-time view of the vulnerabilities affecting your systems using the VUPEN VNS reporting capabilities.
 

 

Try VUPEN VNS 

 

 





© 2004-2010 VUPEN Security - Copyright - Privacy Policy