Vulnerabilities > CVE-2009-0935 - Improper Locking vulnerability in Linux Kernel
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
NONE Integrity impact
NONE Availability impact
HIGH Summary
The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leveraging Race Conditions This attack targets a race condition occurring when multiple processes access and manipulate the same resource concurrently and the outcome of the execution depends on the particular order in which the access takes place. The attacker can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance a race condition can occur while accessing a file, the attacker can trick the system by replacing the original file with his version and cause the system to read the malicious file.
- Leveraging Race Conditions via Symbolic Links This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to her. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file she will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.
Seebug
bulletinFamily | exploit |
description | BUGTRAQ ID: 33624 CVE(CAN) ID: CVE-2009-0935 Linux Kernel是开放源码操作系统Linux所使用的内核。 如果用户空间向inotify例程的read()函数提供了无效指针的话,就会两次解锁inotify设备的事件列表互斥体,这可能导致数据结构处于未受保护的状态,然后用户可以通过从多个不同的任务同时访问inotify例程触发崩溃。 Linux kernel 2.6.x 厂商补丁: Linux ----- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://kernel.org/pub/linux/kernel/v2.6/patch-2.6.28.3.bz2 target=_blank rel=external nofollow>http://kernel.org/pub/linux/kernel/v2.6/patch-2.6.28.3.bz2</a> |
id | SSV:4938 |
last seen | 2017-11-19 |
modified | 2009-03-23 |
published | 2009-03-23 |
reporter | Root |
title | Linux Kernel inotify_read()函数本地拒绝服务漏洞 |
Statements
contributor | Tomas Hoger |
lastmodified | 2009-04-15 |
organization | Red Hat |
statement | Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, 5, or Red Hat Enterprise MRG. |
References
- http://marc.info/?l=linux-kernel&m=123337123501681&w=2
- http://marc.info/?l=linux-kernel&m=123337123501681&w=2
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.3
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.3
- http://www.openwall.com/lists/oss-security/2009/03/06/2
- http://www.openwall.com/lists/oss-security/2009/03/06/2
- http://www.openwall.com/lists/oss-security/2009/03/18/5
- http://www.openwall.com/lists/oss-security/2009/03/18/5
- http://www.openwall.com/lists/oss-security/2009/03/19/2
- http://www.openwall.com/lists/oss-security/2009/03/19/2
- http://www.securityfocus.com/bid/33624
- http://www.securityfocus.com/bid/33624
- https://bugzilla.redhat.com/show_bug.cgi?id=488935
- https://bugzilla.redhat.com/show_bug.cgi?id=488935
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49331
- https://exchange.xforce.ibmcloud.com/vulnerabilities/49331