CVE-2009-3725

The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/	Exploit Third Party Advisory
http://www.securityfocus.com/bid/36834	Patch Third Party Advisory
http://marc.info/?l=oss-security&m=125715484511380&w=2	Mailing List Third Party Advisory
http://marc.info/?l=oss-security&m=125716192622235&w=2	Mailing List Third Party Advisory
http://secunia.com/advisories/37113	Third Party Advisory
http://patchwork.kernel.org/patch/51384/	Patch Vendor Advisory
http://patchwork.kernel.org/patch/51387/	Patch Vendor Advisory
http://patchwork.kernel.org/patch/51382/	Patch Vendor Advisory
http://marc.info/?l=linux-kernel&m=125449888416314&w=2	Mailing List Third Party Advisory
http://patchwork.kernel.org/patch/51383/	Patch Vendor Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.5	Vendor Advisory
http://www.ubuntu.com/usn/usn-864-1	Third Party Advisory
http://secunia.com/advisories/38905	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:8.04::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*

Information

Published : 2009-11-06 07:30

Updated : 2018-11-16 07:46

NVD link : CVE-2009-3725

Mitre link : CVE-2009-3725

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

canonical

ubuntu_linux

linux

linux_kernel

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/", "name": "http://xorl.wordpress.com/2009/10/31/linux-kernel-multiple-capabilities-missing-checks/", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/36834", "name": "36834", "tags": ["Patch", "Third Party Advisory"], "refsource": "BID"}, {"url": "http://marc.info/?l=oss-security&m=125715484511380&w=2", "name": "[oss-security] 20091102 CVE request: kernel: connector security bypass", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://marc.info/?l=oss-security&m=125716192622235&w=2", "name": "[oss-security] 20091102 Re: CVE request: kernel: connector security bypass", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://secunia.com/advisories/37113", "name": "37113", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://patchwork.kernel.org/patch/51384/", "name": "http://patchwork.kernel.org/patch/51384/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://patchwork.kernel.org/patch/51387/", "name": "http://patchwork.kernel.org/patch/51387/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://patchwork.kernel.org/patch/51382/", "name": "http://patchwork.kernel.org/patch/51382/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://marc.info/?l=linux-kernel&m=125449888416314&w=2", "name": "[linux-kernel] 20091002 Re: [PATCH 0/8] SECURITY ISSUE with connector", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://patchwork.kernel.org/patch/51383/", "name": "http://patchwork.kernel.org/patch/51383/", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.5", "name": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.31.5", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.ubuntu.com/usn/usn-864-1", "name": "USN-864-1", "tags": ["Third Party Advisory"], "refsource": "UBUNTU"}, {"url": "http://secunia.com/advisories/38905", "name": "38905", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2009-3725", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2009-11-06T15:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2.6.31.5"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-11-16T15:46Z"}