CVE-2009-0029
published 2009-01-15CVE-2009-0029: The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was…
PriorityP425high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.42%
34.4th percentile
The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | <= 2.6.28 | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
vendor_ubuntu4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-04-07·CVSS 4.0
CVE-2009-0029 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
NFS did not correctly handle races between fcntl and interrupts. A local
attacker on an NFS mount could consume unlimited kernel memory, leading to
a denial of service. (CVE-2008-4307)
Sparc syscalls did not correctly check mmap regions. A local attacker could
cause a system panic, leading to a denial of service. (CVE-2008-6107)
In certain situations, cloned processes were able to send signals to parent
processes, crossing privilege boundaries. A local attacker could send
arbitrary signals to parent processes, leading to a denial of service.
(CVE-2009-0028)
The 64-bit syscall interfaces did not correctly handle sign extension. A
local attacker could make malicious syscalls, possibly gaining root
privileges. The
Red Hat
Linux Kernel insecure 64 bit system call argument passing
vendor_redhat·2009-01-10·CVSS 7.2
CVE-2009-0029 [HIGH] CWE-681 Linux Kernel insecure 64 bit system call argument passing
Linux Kernel insecure 64 bit system call argument passing
The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call.
Statement: This flaw affects most 64-bit architectures, including IBM S/390 and 64-bit PowerPC, but it does not affect x86_64 or Intel Itanium. The risks associated with fixing this flaw are greater than the security risk. We therefore currently have no plans to fix this flaw in Red Hat Enterprise Linux 3, 4, or 5. Red Hat Enterprise MRG is not affected as it is not supported
GHSA
GHSA-4cr9-h3gm-wcrx: The ABI in the Linux kernel 2
ghsa_unreviewed·2022-05-02
CVE-2009-0029 [HIGH] CWE-20 GHSA-4cr9-h3gm-wcrx: The ABI in the Linux kernel 2
The ABI in the Linux kernel 2.6.28 and earlier on s390, powerpc, sparc64, and mips 64-bit platforms requires that a 32-bit argument in a 64-bit register was properly sign extended when sent from a user-mode application, but cannot verify this, which allows local users to cause a denial of service (crash) or possibly gain privileges via a crafted system call.
Kernel
MIPS: Remove unused sys_32_mmap2
kernel_security·2018-08-01·CVSS 7.2
CVE-2009-0029 [HIGH] MIPS: Remove unused sys_32_mmap2
MIPS: Remove unused sys_32_mmap2
The sys_32_mmap2 function has been unused since we started using syscall
wrappers in commit dbda6ac08976 ("MIPS: CVE-2009-0029: Enable syscall
wrappers."), and is indeed identical to the sys_mips_mmap2 function that
replaced it in sys32_call_table.
Remove the dead code.
Signed-off-by: Paul Burton
Patchwork: https://patchwork.linux-mips.org/patch/20107/
Cc: James Hogan
Cc: Ralf Baechle
Cc: [email protected]
Kernel
tilegx: enable SYSCALL_WRAPPERS support
kernel_security·2012-05-18·CVSS 7.2
CVE-2009-0029 [HIGH] tilegx: enable SYSCALL_WRAPPERS support
tilegx: enable SYSCALL_WRAPPERS support
Some discussion with the glibc mailing lists revealed that this was
necessary for 64-bit platforms with MIPS-like sign-extension rules
for 32-bit values. The original symptom was that passing (uid_t)-1 to
setreuid() was failing in programs linked -pthread because of the "setxid"
mechanism for passing setxid-type function arguments to the syscall code.
SYSCALL_WRAPPERS handles ensuring that all syscall arguments end up with
proper sign-extension and is thus the appropriate fix for this problem.
On other platforms (s390, powerpc, sparc64, and mips) this was fixed
in 2.6.28.6. The general issue is tracked as CVE-2009-0029.
Cc:
Signed-off-by: Chris Metcalf
No detection rules found.
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.htmlhttp://marc.info/?l=linux-kernel&m=123155111608910&w=2http://secunia.com/advisories/33477http://secunia.com/advisories/33674http://secunia.com/advisories/34394http://secunia.com/advisories/34981http://secunia.com/advisories/35011http://www.debian.org/security/2009/dsa-1749http://www.debian.org/security/2009/dsa-1787http://www.debian.org/security/2009/dsa-1794http://www.mandriva.com/security/advisories?name=MDVSA-2009:135http://www.securityfocus.com/bid/33275https://bugzilla.redhat.com/show_bug.cgi?id=479969https://www.redhat.com/archives/fedora-package-announce/2009-January/msg01045.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-02/msg00003.htmlhttp://marc.info/?l=linux-kernel&m=123155111608910&w=2http://secunia.com/advisories/33477http://secunia.com/advisories/33674http://secunia.com/advisories/34394http://secunia.com/advisories/34981http://secunia.com/advisories/35011http://www.debian.org/security/2009/dsa-1749http://www.debian.org/security/2009/dsa-1787http://www.debian.org/security/2009/dsa-1794http://www.mandriva.com/security/advisories?name=MDVSA-2009:135http://www.securityfocus.com/bid/33275https://bugzilla.redhat.com/show_bug.cgi?id=479969https://www.redhat.com/archives/fedora-package-announce/2009-January/msg01045.html
2009-01-15
Published