中危 Linux Kernel 2.4 / 2.6 - 'sock_sendpage()' 权限提升漏洞

CVE编号

CVE-2009-2692

利用情况

POC 已公开

补丁情况

官方补丁

披露时间

2009-08-15
漏洞描述
Linux内核2.6.0至2.6.30.4和2.4.4至2.4.37.4没有初始化Proto_ops结构中套接字操作的所有函数指针,该结构允许本地用户通过使用mmap映射页面零、在此页上放置任意代码,然后调用不可用的操作,如在PF_PPO X套接字上的发送页操作(sock_sendpage函数)所示。
解决建议
建议您更新当前系统或软件至最新版,完成漏洞的修复。
参考链接
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html
http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commi...
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3...
http://grsecurity.net/~spender/wunderbar_emporium.tgz
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html
http://rhn.redhat.com/errata/RHSA-2009-1222.html
http://rhn.redhat.com/errata/RHSA-2009-1223.html
http://secunia.com/advisories/36278
http://secunia.com/advisories/36289
http://secunia.com/advisories/36327
http://secunia.com/advisories/36430
http://secunia.com/advisories/37298
http://secunia.com/advisories/37471
http://support.avaya.com/css/P8/documents/100067254
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121
http://www.debian.org/security/2009/dsa-1865
http://www.exploit-db.com/exploits/19933
http://www.exploit-db.com/exploits/9477
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6
http://www.mandriva.com/security/advisories?name=MDVSA-2009:233
http://www.openwall.com/lists/oss-security/2009/08/14/1
http://www.redhat.com/support/errata/RHSA-2009-1233.html
http://www.securityfocus.com/archive/1/505751/100/0/threaded
http://www.securityfocus.com/archive/1/505912/100/0/threaded
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/archive/1/512019/100/0/threaded
http://www.securityfocus.com/bid/36038
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/2272
http://www.vupen.com/english/advisories/2009/3316
http://zenthought.org/content/file/android-root-2009-08-16-source
https://bugzilla.redhat.com/show_bug.cgi?id=516949
https://issues.rpath.com/browse/RPL-3103
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
应用 linux kernel 2.6.24.7 -
运行在以下环境
应用 linux kernel 2.6.25.15 -
运行在以下环境
系统 centos_5 kernel * Up to
(excluding)
2.6.18-128.7.1.el5
运行在以下环境
系统 opensuse_10.3 kernel * Up to
(excluding)
2.6.22.19-0.4
运行在以下环境
系统 opensuse_11.0 kernel * Up to
(excluding)
2.6.25.20-0.5
运行在以下环境
系统 opensuse_11.1 kernel * Up to
(excluding)
2.6.27.29-0.1.1
运行在以下环境
系统 oracle_5 kernel * Up to
(excluding)
1.2.9-1.el5
运行在以下环境
系统 redhat_5 kernel * Up to
(excluding)
0:2.6.18-128.7.1.el5
运行在以下环境
系统 suse_11 ext4dev-kmp-default * Up to
(excluding)
0_2.6.27.29_0.1-7.1
阿里云评分
4.5
  • 攻击路径
    本地
  • 攻击复杂度
    困难
  • 权限要求
    普通权限
  • 影响范围
    越权影响
  • EXP成熟度
    POC 已公开
  • 补丁情况
    官方补丁
  • 数据保密性
    数据泄露
  • 数据完整性
    无影响
  • 服务器危害
    服务器失陷
  • 全网数量
    N/A
CWE-ID 漏洞类型
CWE-119 内存缓冲区边界内操作的限制不恰当
CWE-908 对未经初始化资源的使用
阿里云安全产品覆盖情况