NVD

Id
49936  
Name
CVE-2009-2695  
Description
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2009-08-28  
Modified Date
2012-03-19  
Seq
2009-2695  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
252679 49936 CVE-2009-2695 http://danwalsh.livejournal.com/30084.html  View
252680 49936 CVE-2009-2695 http://eparis.livejournal.com/606.html  View
252681 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=47d439e9fb8a81a90022cfa785bf1c36c4e2aff6  View
252682 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=7c73875e7dda627040b12c19b01db634fa7f0fd1  View
252683 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=84336d1a77ccd2c06a730ddd38e695c2324a7386  View
252684 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/jmorris/security-testing-2.6.git;a=commit;h=a2551df7ec568d87793d2eea4ca744e86318f205  View
252685 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d9959734a1949ea4f2427bd2d8b21ede6b2441c  View
252686 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=788084aba2ab7348257597496befcbccabdc98a3  View
252687 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8cf948e744e0218af604c32edecde10006dc8e9e  View
252688 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3  View
252689 49936 CVE-2009-2695 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ab5a91a8364c3d6fc617abc47cc81d162c01d90a  View
252690 49936 CVE-2009-2695 http://kbase.redhat.com/faq/docs/DOC-18042  View
252691 49936 CVE-2009-2695 [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates  View
252692 49936 CVE-2009-2695 oval:org.mitre.oval:def:7144  View
252693 49936 CVE-2009-2695 oval:org.mitre.oval:def:9882  View
252694 49936 CVE-2009-2695 http://patchwork.kernel.org/patch/36539/  View
252695 49936 CVE-2009-2695 http://patchwork.kernel.org/patch/36540/  View
252696 49936 CVE-2009-2695 http://patchwork.kernel.org/patch/36649/  View
252697 49936 CVE-2009-2695 http://patchwork.kernel.org/patch/36650/  View
252698 49936 CVE-2009-2695 http://thread.gmane.org/gmane.linux.kernel.lsm/9075  View
252699 49936 CVE-2009-2695 http://twitter.com/spendergrsec/statuses/3303390960  View
252700 49936 CVE-2009-2695 DSA-2005  View
252701 49936 CVE-2009-2695 http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc7  View
252702 49936 CVE-2009-2695 [oss-security] 20090817 SELinux and mmap_min_addr behaviour (CVE-2009-2695)  View
252703 49936 CVE-2009-2695 RHSA-2009:1672  View
252704 49936 CVE-2009-2695 36051  View
252705 49936 CVE-2009-2695 USN-852-1  View
252706 49936 CVE-2009-2695 ADV-2010-0528  View
252707 49936 CVE-2009-2695 https://bugzilla.redhat.com/show_bug.cgi?id=511143  View
252708 49936 CVE-2009-2695 https://bugzilla.redhat.com/show_bug.cgi?id=517830  View
252709 49936 CVE-2009-2695 RHSA-2009:1540  View
252710 49936 CVE-2009-2695 RHSA-2009:1548  View
252711 49936 CVE-2009-2695 FEDORA-2009-9044  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41352 JVNDB-2009-002359 Linux Kernel における権限昇格の脆弱性 Linux Kernel には、ゼロページおよび他の低メモリアドレスをターゲットとする mmap 操作が適切に制御されないため、権限昇格の脆弱性が存在します。 CVE-2009-2695 40126 CVE-2009-2695 49936 7.2 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002359.html 2009-08-28 2010-01-26 View