Buffer overflow in Linux kernel

1) Buffer overflow

EUVDB-ID: #VU93807

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2009-1192

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to gain access to sensitive information.

The (1) agp_generic_alloc_page and (2) agp_generic_alloc_pages functions in drivers/char/agp/generic.c in the agp subsystem in the Linux kernel before 2.6.30-rc3 do not 0 out pages that may later be available to a user-space process, which allows local users to obtain sensitive information by reading these pages.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://www.securityfocus.com/bid/34673
https://bugzilla.redhat.com/show_bug.cgi?id=497020
https://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.30-rc3
https://openwall.com/lists/oss-security/2009/04/22/2
https://secunia.com/advisories/34981
https://secunia.com/advisories/35011
https://secunia.com/advisories/35121
https://www.mandriva.com/security/advisories?name=MDVSA-2009:119
https://wiki.rpath.com/Advisories:rPSA-2009-0084
https://secunia.com/advisories/35120
https://www.redhat.com/support/errata/RHSA-2009-1081.html
https://lists.opensuse.org/opensuse-security-announce/2009-06/msg00002.html
https://www.mandriva.com/security/advisories?name=MDVSA-2009:135
https://secunia.com/advisories/35387
https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html
https://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html
https://secunia.com/advisories/37351
https://www.vmware.com/security/advisories/VMSA-2009-0016.html
https://www.vupen.com/english/advisories/2009/3316
https://secunia.com/advisories/37471
https://www.ubuntu.com/usn/usn-793-1
https://secunia.com/advisories/35656
https://secunia.com/advisories/35343
https://www.debian.org/security/2009/dsa-1787
https://www.debian.org/security/2009/dsa-1794
https://www.debian.org/security/2009/dsa-1800
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8003
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10567
https://www.securityfocus.com/archive/1/507985/100/0/threaded
https://www.securityfocus.com/archive/1/503610/100/0/threaded
https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=59de2bebabc5027f93df999d59cc65df591c3e6e

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.