CVE-2009-1072

CWE-167 documents6 sources
Severity
4.9MEDIUM
EPSS
0.6%
top 30.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Linux Linux KernelCanonical Ubuntu LinuxDebian Debian Linux+8 more
Timeline
PublishedMar 25
Latest updateMay 2

Description

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.

CVSS vector

AV:L/AC:L/C:N/I:C/A:NExploitability: 3.9 | Impact: 6.9

Affected Packages9 packages

▶NVDlinux/linux_kernel< 2.6.28.9
▶NVDvmware/esx3.0.3, 3.5, 4.0+2
▶NVDvmware/vma4.0

Also affects: Debian Linux 4.0, 5.0, Ubuntu Linux 6.06, 8.04, 8.10, 9.04

🔴Vulnerability Details

2
GHSA
GHSA-pxr6-gr2r-cc6x: nfsd in the Linux kernel before 2↗2022-05-02
▶
CVEList
CVE-2009-1072: nfsd in the Linux kernel before 2↗2009-03-25
▶

📋Vendor Advisories

2
Ubuntu
Linux kernel vulnerabilities↗2009-07-02
▶
Red Hat
kernel: nfsd should drop CAP_MKNOD for non-root↗2009-03-19
▶

💬Community

2
Bugzilla
CVE-2009-1072 kernel: nfsd should drop CAP_MKNOD for non-root [rhel-4.9]↗2009-05-20
▶
Bugzilla
CVE-2009-1072 kernel: nfsd should drop CAP_MKNOD for non-root↗2009-03-23
▶
CVE-2009-1072 (MEDIUM CVSS 4.9) | nfsd in the Linux kernel before 2.6 | cvebase.io