Privilege escalation in Linux Kernel
CVE-2009-2848
The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
Vulnerability class: Privilege Escalation
EPSS: 0.005 (41.0th percentile) — read the EPSS interpretation.
Affected products
- Linux Linux_kernel — versions 2.6.30
- Novell Linux_desktop — versions 9
- Vmware Esx — versions 4.0
- Vmware Vma — versions 4.0
- Canonical Ubuntu_linux — versions 6.06, 8.04, 8.10
- Fedoraproject Fedora — versions 11
- Opensuse — versions 11.0
- Redhat Enterprise_linux — versions 5.0
- Redhat Enterprise_linux_desktop — versions 3.0, 5.0
- Redhat Enterprise_linux_server — versions 3.0, 5.0
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- cve@mitre.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
- cve@mitre.org (signature, x_refsource_OVAL, Third Party Advisory, vdb-entry)