CVE-2009-2911

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow, or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables, related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records.

CVSS v2.0 1.9 LOW

1.9^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/36778
http://sources.redhat.com/bugzilla/show_bug.cgi?id=10750	Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=529175
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41633
http://www.openwall.com/lists/oss-security/2009/10/21/1	Patch
http://www.vupen.com/english/advisories/2009/2989	Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00627.html
http://secunia.com/advisories/37167
https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00793.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:systemtap:systemtap:1.0:*:*:*:*:*:*:*

Information

Published : 2009-10-22 09:30

Updated : 2009-10-30 23:22

NVD link : CVE-2009-2911

Mitre link : CVE-2009-2911

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

systemtap

systemtap

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/36778", "name": "36778", "tags": [], "refsource": "BID"}, {"url": "http://sources.redhat.com/bugzilla/show_bug.cgi?id=10750", "name": "http://sources.redhat.com/bugzilla/show_bug.cgi?id=10750", "tags": ["Exploit"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=529175", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=529175", "tags": [], "refsource": "CONFIRM"}, {"url": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41633", "name": "http://gcc.gnu.org/bugzilla/show_bug.cgi?id=41633", "tags": [], "refsource": "MISC"}, {"url": "http://www.openwall.com/lists/oss-security/2009/10/21/1", "name": "[oss-security] 20091021 CVE assignment notification -- CVE-2009-2911 - Three SystemTap-1.0 DoS issues", "tags": ["Patch"], "refsource": "MLIST"}, {"url": "http://www.vupen.com/english/advisories/2009/2989", "name": "ADV-2009-2989", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00627.html", "name": "FEDORA-2009-10719", "tags": [], "refsource": "FEDORA"}, {"url": "http://secunia.com/advisories/37167", "name": "37167", "tags": [], "refsource": "SECUNIA"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2009-October/msg00793.html", "name": "FEDORA-2009-10849", "tags": [], "refsource": "FEDORA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow, or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables, related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-2911", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-10-22T16:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:systemtap:systemtap:1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2009-10-31T06:22Z"}

1.9 /10