National Cyber Awareness System

Vulnerability Summary for CVE-2009-2695

Overview

The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 36051

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/36051

External Source: CONFIRM

Name: http://patchwork.kernel.org/patch/36649/

Type: Patch Information

Hyperlink:http://patchwork.kernel.org/patch/36649/

External Source: FEDORA

Name: FEDORA-2009-9044

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01256.html

External Source: REDHAT

Name: RHSA-2009:1548

Hyperlink:https://rhn.redhat.com/errata/RHSA-2009-1548.html

External Source: REDHAT

Name: RHSA-2009:1540

Hyperlink:https://rhn.redhat.com/errata/RHSA-2009-1540.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=517830

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=517830

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=511143

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=511143

External Source: VUPEN

Name: ADV-2010-0528

Hyperlink:http://www.vupen.com/english/advisories/2010/0528

External Source: UBUNTU

Name: USN-852-1

Hyperlink:http://www.ubuntu.com/usn/USN-852-1

External Source: REDHAT

Name: RHSA-2009:1672

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-1672.html

External Source: MLIST

Name: [oss-security] 20090817 SELinux and mmap_min_addr behaviour (CVE-2009-2695)

Hyperlink:http://www.openwall.com/lists/oss-security/2009/08/17/4

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc7

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc7

External Source: DEBIAN

Name: DSA-2005

Hyperlink:http://www.debian.org/security/2010/dsa-2005

External Source: MISC

Name: http://twitter.com/spendergrsec/statuses/3303390960

Hyperlink:http://twitter.com/spendergrsec/statuses/3303390960

External Source: CONFIRM

Name: http://thread.gmane.org/gmane.linux.kernel.lsm/9075

Hyperlink:http://thread.gmane.org/gmane.linux.kernel.lsm/9075

External Source: SECUNIA

Name: 38834

Hyperlink:http://secunia.com/advisories/38834

External Source: SECUNIA

Name: 38794

Hyperlink:http://secunia.com/advisories/38794

External Source: SECUNIA

Name: 37105

Hyperlink:http://secunia.com/advisories/37105

External Source: SECUNIA

Name: 36501

Type: Advisory

Hyperlink:http://secunia.com/advisories/36501

External Source: CONFIRM

Name: http://patchwork.kernel.org/patch/36650/

Hyperlink:http://patchwork.kernel.org/patch/36650/

External Source: CONFIRM

Name: http://patchwork.kernel.org/patch/36540/

Hyperlink:http://patchwork.kernel.org/patch/36540/

External Source: CONFIRM

Name: http://patchwork.kernel.org/patch/36539/

Hyperlink:http://patchwork.kernel.org/patch/36539/

External Source: OVAL

Name: oval:org.mitre.oval:def:9882

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9882

External Source: OVAL

Name: oval:org.mitre.oval:def:7144

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7144

External Source: MLIST

Name: [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates

Hyperlink:http://lists.vmware.com/pipermail/security-announce/2010/000082.html

External Source: CONFIRM

Name: http://kbase.redhat.com/faq/docs/DOC-18042

Hyperlink:http://kbase.redhat.com/faq/docs/DOC-18042

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ab5a91a8364c3d6fc617abc47cc81d162c01d90a

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ab5a91a8364c3d6fc617abc47cc81d162c01d90a

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8cf948e744e0218af604c32edecde10006dc8e9e

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8cf948e744e0218af604c32edecde10006dc8e9e

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=788084aba2ab7348257597496befcbccabdc98a3

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=788084aba2ab7348257597496befcbccabdc98a3

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d9959734a1949ea4f2427bd2d8b21ede6b2441c

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d9959734a1949ea4f2427bd2d8b21ede6b2441c

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=a2551df7ec568d87793d2eea4ca744e86318f205

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=a2551df7ec568d87793d2eea4ca744e86318f205

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=84336d1a77ccd2c06a730ddd38e695c2324a7386

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=84336d1a77ccd2c06a730ddd38e695c2324a7386

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=7c73875e7dda627040b12c19b01db634fa7f0fd1

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=7c73875e7dda627040b12c19b01db634fa7f0fd1

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=47d439e9fb8a81a90022cfa785bf1c36c4e2aff6

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=47d439e9fb8a81a90022cfa785bf1c36c4e2aff6

External Source: CONFIRM

Name: http://eparis.livejournal.com/606.html

Hyperlink:http://eparis.livejournal.com/606.html

External Source: CONFIRM

Name: http://danwalsh.livejournal.com/30084.html

Hyperlink:http://danwalsh.livejournal.com/30084.html

References to Check Content

Identifier:oval:org.mitre.oval:def:7144

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:7144

Identifier:oval:org.mitre.oval:def:9882

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:9882