#VU92663 Configuration in Linux kernel - CVE-2009-1895
Vulnerability identifier: #VU92663
Vulnerability risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-16
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to configuration error. A local user can execute arbitrary code.
Mitigation
Install update from vendor's repository.
Vulnerable software versions
Linux kernel: All versions
External links
https://bugs.launchpad.net/bugs/cve/2009-1895
https://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc3
https://www.vupen.com/english/advisories/2009/1866
https://www.securityfocus.com/bid/35647
https://www.osvdb.org/55807
https://patchwork.kernel.org/patch/32598/
https://secunia.com/advisories/35801
https://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html
https://www.ubuntu.com/usn/usn-807-1
https://secunia.com/advisories/36054
https://secunia.com/advisories/36045
https://secunia.com/advisories/36051
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00223.html
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00166.html
https://wiki.rpath.com/Advisories:rPSA-2009-0111
https://secunia.com/advisories/36116
https://www.redhat.com/support/errata/RHSA-2009-1193.html
https://secunia.com/advisories/36131
https://secunia.com/advisories/36759
https://www.redhat.com/support/errata/RHSA-2009-1438.html
https://rhn.redhat.com/errata/RHSA-2009-1540.html
https://rhn.redhat.com/errata/RHSA-2009-1550.html
https://www.vmware.com/security/advisories/VMSA-2009-0016.html
https://www.vupen.com/english/advisories/2009/3316
https://secunia.com/advisories/37471
https://www.mandriva.com/security/advisories?name=MDVSA-2011:051
https://www.debian.org/security/2009/dsa-1844
https://www.debian.org/security/2009/dsa-1845
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9453
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7826
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11768
https://www.securityfocus.com/archive/1/512019/100/0/threaded
https://www.securityfocus.com/archive/1/507985/100/0/threaded
https://www.securityfocus.com/archive/1/505254/100/0/threaded
https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
