Published: 16/07/2009 Updated: 13/02/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

VMScore: 642

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

The personality subsystem in the Linux kernel prior to 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
linux linux kernel 2.6.31
debian debian linux 5.0
debian debian linux 4.0
canonical ubuntu linux 6.06
canonical ubuntu linux 9.04
canonical ubuntu linux 8.04
canonical ubuntu linux 8.10

Michael Tokarev discovered that the RTL8169 network driver did not correctly validate buffer sizes A remote attacker on the local network could send specially crafted traffic that would crash the system or potentially grant elevated privileges (CVE-2009-1389) ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix several security issues and several bugsare now available for Red Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Secur ...

Synopsis Important: kernel security and bug fix update Type/Severity Security Advisory: Important Topic Updated kernel packages that fix multiple security issues and several bugsare now available for Red Hat Enterprise Linux 52 Extended Update SupportThis update has been rated as having important security ...

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, or privilege escalation The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1895 Julien Tinnes and Tavis Ormandy reported an issue in the Linux personality code Local users can take advantage of ...

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-1385 Neil Horman discovered a missing fix from the e1000 network driver A remote user may cause a denial of service by w ...

CWE-16 https://bugs.launchpad.net/bugs/cve/2009-1895 http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc3 http://www.vupen.com/english/advisories/2009/1866 http://www.securityfocus.com/bid/35647 http://www.osvdb.org/55807 http://patchwork.kernel.org/patch/32598/http://secunia.com/advisories/35801 http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html http://www.ubuntu.com/usn/usn-807-1 http://secunia.com/advisories/36054 http://secunia.com/advisories/36045 http://secunia.com/advisories/36051 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00223.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00166.html http://wiki.rpath.com/Advisories:rPSA-2009-0111 http://secunia.com/advisories/36116 http://www.redhat.com/support/errata/RHSA-2009-1193.html http://secunia.com/advisories/36131 http://secunia.com/advisories/36759 http://www.redhat.com/support/errata/RHSA-2009-1438.html https://rhn.redhat.com/errata/RHSA-2009-1540.html https://rhn.redhat.com/errata/RHSA-2009-1550.html http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://www.vupen.com/english/advisories/2009/3316 http://secunia.com/advisories/37471 http://www.mandriva.com/security/advisories?name=MDVSA-2011:051 http://www.debian.org/security/2009/dsa-1844 http://www.debian.org/security/2009/dsa-1845 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9453 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7826 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11768 http://www.securityfocus.com/archive/1/512019/100/0/threaded http://www.securityfocus.com/archive/1/507985/100/0/threaded http://www.securityfocus.com/archive/1/505254/100/0/threaded http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6 https://usn.ubuntu.com/807-1/https://nvd.nist.gov

CVE-2009-1895

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect