Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:L/AC:L/Au:N/C:C/I:C/A:C)
Производитель ПО
Наименование ПО
kernel-bigsmp
(E10SP2 - 0, E10SP2 - 2.6.16.60-0.42.4, OS10r3 - 0, OS10r3 - 2.6.22.19-0.4)
kernel-debug
(ES10SP2 - 0, ES10SP2 - 2.6.16.60-0.42.4, OS10r3 - 0, OS10r3 - 2.6.22.19-0.4, OS11r0 - 0, OS11r0 - 2.6.25.20-0.5, OS11r1 - 0, OS11r1 - 2.6.27.29-0.1.1)
kernel-xen
(E10SP2 - 0, E10SP2 - 2.6.16.60-0.42.4, E11SP0 - 0, E11SP0 - 2.6.27.29-0.1.1, OS11r0 - 0, OS11r0 - 2.6.25.20-0.5, OS11r1 - 0, OS11r1 - 2.6.27.29-0.1.1)
kernel-xenpae
(E10SP2 - 0, E10SP2 - 2.6.16.60-0.42.4, OS10r3 - 0, OS10r3 - 2.6.22.19-0.4)
Linux Kernel
(Unknown)
Описание
Linux kernel не инициализирует все указатели функции для операций с сокетами в структурах proto_ops, что позволяет локальным пользователям вызвать разыменование нулевого указателя и повысить свои привилегии, используя mmap, чтобы map page zero, поместить произвольный код на данную страницу и затем вызвать попытаться выполнить недоступную операцию, как показано на примере операции sendpage (функция sock_sendpage) на сокете PF_PPPOX.
Как исправить
Для устранения уязвимости необходимо установить последнюю версию продукта, соответствующую используемой платформе. Необходимую информацию можно получить по адресу:
http://www.kernel.org/
http://www.kernel.org/
Ссылки
VUPEN (ADV-2009-2272): http://www.vupen.com/english/advisories/2009/2272
CONFIRM (https://issues.rpath.com/browse/RPL-3103): https://issues.rpath.com/browse/RPL-3103
CONFIRM (https://bugzilla.redhat.com/show_bug.cgi?id=516949): https://bugzilla.redhat.com/show_bug.cgi?id=516949
MISC (http://zenthought.org/content/file/android-root-2009-08-16-source): http://zenthought.org/content/file/android-root-2009-08-16-source
BID (36038): http://www.securityfocus.com/bid/36038
BUGTRAQ (20090818 rPSA-2009-0121-1 kernel open-vm-tools): http://www.securityfocus.com/archive/1/archive/1/505912/100/0/threaded
BUGTRAQ (20090813 Linux NULL pointer dereference due to incorrect proto_ops initializations): http://www.securityfocus.com/archive/1/archive/1/505751/100/0/threaded
MILW0RM (9477): http://www.milw0rm.com/exploits/9477
CONFIRM (http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6): http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6
CONFIRM (http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5): http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5
CONFIRM (http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5): http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5
CONFIRM (http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121): http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121
REDHAT (RHSA-2009:1223): http://rhn.redhat.com/errata/RHSA-2009-1223.html
REDHAT (RHSA-2009:1222): http://rhn.redhat.com/errata/RHSA-2009-1222.html
MISC (http://grsecurity.net/~spender/wunderbar_emporium.tgz): http://grsecurity.net/~spender/wunderbar_emporium.tgz
CONFIRM (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98): http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98
CONFIRM (http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=c18d0fe535a73b219f960d1af3d0c264555a12e3): http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=c18d0fe535a73b219f960d1af3d0c264555a12e3
MISC (http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html): http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html
FULLDISC (20090813 Linux NULL pointer dereference due to incorrect proto_ops initializations): http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html
CONFIRM (https://issues.rpath.com/browse/RPL-3103): https://issues.rpath.com/browse/RPL-3103
CONFIRM (https://bugzilla.redhat.com/show_bug.cgi?id=516949): https://bugzilla.redhat.com/show_bug.cgi?id=516949
MISC (http://zenthought.org/content/file/android-root-2009-08-16-source): http://zenthought.org/content/file/android-root-2009-08-16-source
BID (36038): http://www.securityfocus.com/bid/36038
BUGTRAQ (20090818 rPSA-2009-0121-1 kernel open-vm-tools): http://www.securityfocus.com/archive/1/archive/1/505912/100/0/threaded
BUGTRAQ (20090813 Linux NULL pointer dereference due to incorrect proto_ops initializations): http://www.securityfocus.com/archive/1/archive/1/505751/100/0/threaded
MILW0RM (9477): http://www.milw0rm.com/exploits/9477
CONFIRM (http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6): http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6
CONFIRM (http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5): http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5
CONFIRM (http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5): http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5
CONFIRM (http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121): http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121
REDHAT (RHSA-2009:1223): http://rhn.redhat.com/errata/RHSA-2009-1223.html
REDHAT (RHSA-2009:1222): http://rhn.redhat.com/errata/RHSA-2009-1222.html
MISC (http://grsecurity.net/~spender/wunderbar_emporium.tgz): http://grsecurity.net/~spender/wunderbar_emporium.tgz
CONFIRM (http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98): http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98
CONFIRM (http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=c18d0fe535a73b219f960d1af3d0c264555a12e3): http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=c18d0fe535a73b219f960d1af3d0c264555a12e3
MISC (http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html): http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html
FULLDISC (20090813 Linux NULL pointer dereference due to incorrect proto_ops initializations): http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html
