CVE-2009-1185
published 2009-04-17CVE-2009-1185: udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK…
PriorityP356high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
80.55%
99.6th percentile
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| juniper | ctpview | < 7.1 | 7.1 |
| juniper | ctpview | — | — |
| juniper | ctpview | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| udev_project | udev | < 141 | 141 |
| vmware | esxi | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect userspace processes opening AF_NETLINK / NETLINK_KOBJECT_UEVENT (protocol 15) sockets and sending NETLINK messages — legitimate uevent messages should only originate from PID 0 (kernel). Any non-zero nl_pid sending to the udevd netlink socket is suspicious. ↗
- →The exploit sets nl_pid to udevd_PID - 1 (the udevd netlink socket PID found in /proc/net/netlink). Monitor for processes reading /proc/net/netlink and correlating with udevd PID as a pre-exploitation reconnaissance step. ↗
- →Watch for creation of suspicious shared libraries or executables under /tmp (e.g. libno_ex.so.1.0, suid) combined with LD_PRELOAD injection via a crafted NETLINK uevent message. ↗
- →Netlink message crafted with ACTION=remove, SUBSYSTEM=block, and a REMOVE_CMD or LD_PRELOAD field is a strong indicator of CVE-2009-1185 exploitation. These fields do not appear in legitimate kernel-generated uevents. ↗
- →For shell-session detection, look for the shell one-liner iterating /proc/net/netlink and ps output to locate the udevd netlink PID, which is a reliable pre-exploitation fingerprint. ↗
- ·udev packages shipped in Red Hat Enterprise Linux 4 are NOT affected because they do not use netlink sockets for communication. udev is not shipped in RHEL 2.1 and 3 at all — do not apply these detections to those platforms. ↗
- ·VMware ESXi (any version), ESX 3.x/2.x, and all hosted products (Workstation, Player, ACE, Server, Fusion) are NOT affected. Only ESX 4.0 Service Console is affected and was patched via ESX400-200906411-SG. ↗
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.2HIGH
vendor_ubuntu7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
ESX Service Console updates for udev, sudo, and curl
vendor_vmware·2009-07-10·CVSS 7.2
CVE-2009-0034 [HIGH] ESX Service Console updates for udev, sudo, and curl
VMSA-2009-0009: ESX Service Console updates for udev, sudo, and curl
a. Service Console package udev A vulnerability in the udev program did not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2009-1185 to this issue. Please see http://kb.vmware.com/kb/1011786 for details. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product Product Version Running on Replace with/ Apply Patch VMware Product VirtualCenter Product Version any Running on Windows Replace with/ Apply Patch not affected VMware Product hosted * Product Version any Runn
Red Hat
udev: Uncheck origin of NETLINK messages
vendor_redhat·2009-04-15·CVSS 7.2
CVE-2009-1185 [HIGH] CWE-862 udev: Uncheck origin of NETLINK messages
udev: Uncheck origin of NETLINK messages
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
Statement: udev packages as shipped in Red Hat Enterprise Linux 4 are not affected by this flaw, as they do not use netlink sockets for communication. udev is not shipped in Red Hat Enterprise Linux 2.1 and 3.
Ubuntu
udev vulnerabilities
vendor_ubuntu·2009-04-15·CVSS 7.2
CVE-2009-1185 [HIGH] udev vulnerabilities
Title: udev vulnerabilities
Summary: udev vulnerabilities
Sebastian Krahmer discovered that udev did not correctly validate netlink
message senders. A local attacker could send specially crafted messages
to udev in order to gain root privileges. (CVE-2009-1185)
Sebastian Krahmer discovered a buffer overflow in the path encoding routines
in udev. A local attacker could exploit this to crash udev, leading to a
denial of service. (CVE-2009-1186)
Instructions: After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
GHSA
GHSA-3cx7-86h6-xwmp: udev before 1
ghsa_unreviewed·2022-05-02
CVE-2009-1185 [HIGH] CWE-20 GHSA-3cx7-86h6-xwmp: udev before 1
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
No detection rules found.
Exploit-DB
Linux Kernel UDEV < 1.4.1 - 'Netlink' Local Privilege Escalation (Metasploit)
exploitdb·2012-10-10
CVE-2009-1185 Linux Kernel UDEV < 1.4.1 - 'Netlink' Local Privilege Escalation (Metasploit)
Linux Kernel UDEV 'Linux udev Netlink Local Privilege Escalation',
'Description' => %q{
Versions of udev MSF_LICENSE,
'Author' =>
[
'kcope', # discovery
'Jon Oberheide', # 95-udev-late.rules technique
'egypt' # metasploit module
],
'Platform' => [ 'linux' ],
'Arch' => [ ARCH_X86 ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'References' =>
[
[ 'CVE', '2009-1185' ],
[ 'OSVDB', '53810' ],
[ 'BID', '34536' ]
],
'Targets' =>
[
[ 'Linux x86', { 'Arch' => ARCH_X86 } ],
[ 'Linux x64', { 'Arch' => ARCH_X86_64 } ],
#[ 'Command payload', { 'Arch' => ARCH_CMD } ],
],
'DefaultOptons' => { 'WfsDelay' => 2 },
'DefaultTarget' => 0,
'DisclosureDate' => "",
}
))
register_options([
OptString.new("WritableDir", [ true, "A directory where we can write files (must not be mounted noexec)", "/tmp" ]),
OptInt.
Exploit-DB
Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2)
exploitdb·2009-04-30·CVSS 7.2
CVE-2009-1185 [HIGH] Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV < 1.4.1 - Local Privilege Escalation (2)
Linux Kernel 2.6 (Gentoo / Ubuntu 8.10/9.04) UDEV
* http://jon.oberheide.org
*
* Information:
*
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1185
*
* udev before 1.4.1 does not verify whether a NETLINK message originates
* from kernel space, which allows local users to gain privileges by sending
* a NETLINK message from user space.
*
* Notes:
*
* An alternate version of kcope's exploit. This exploit leverages the
* 95-udev-late.rules functionality that is meant to run arbitrary commands
* when a device is removed. A bit cleaner and reliable as long as your
* distro ships that rule file.
*
* Tested on Gentoo, Intrepid, and Jaunty.
*
* Usage:
*
* Pass the PID of the udevd netlink socket (listed in /proc/net/netlink,
* usually is the udevd PID minus 1) as argv[1].
*
* The exploit
Exploit-DB
Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV < 1.4.1 - Local Privilege Escalation (1)
exploitdb·2009-04-20
CVE-2009-1185 Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV < 1.4.1 - Local Privilege Escalation (1)
Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV udev.c
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#ifndef NETLINK_KOBJECT_UEVENT
#define NETLINK_KOBJECT_UEVENT 15
#endif
#define SHORT_STRING 64
#define MEDIUM_STRING 128
#define BIG_STRING 256
#define LONG_STRING 1024
#define EXTRALONG_STRING 4096
#define TRUE 1
#define FALSE 0
int socket_fd;
struct sockaddr_nl address;
struct msghdr msg;
struct iovec iovector;
int sz = 64*1024;
main(int argc, char **argv) {
char sysfspath[SHORT_STRING];
char subsystem[SHORT_STRING];
char event[SHORT_STRING];
char major[SHORT_STRING];
char minor[SHORT_STRING];
sprintf(event, "add");
sprintf(subsystem, "block");
sprintf(sysfspath, "/dev/foo");
sprintf(major, "8");
sprintf(minor, "1");
Metasploit
Linux udev Netlink Local Privilege Escalation
metasploit
Linux udev Netlink Local Privilege Escalation
Linux udev Netlink Local Privilege Escalation
Versions of udev < 1.4.1 do not verify that netlink messages are coming from the kernel. This allows local users to gain privileges by sending netlink messages from userland.
http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e2b362d9f23d4c63018709ab5f81a02f72b91e75http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e86a923d508c2aed371cdd958ce82489cf2ab615http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00012.htmlhttp://lists.vmware.com/pipermail/security-announce/2009/000060.htmlhttp://secunia.com/advisories/34731http://secunia.com/advisories/34750http://secunia.com/advisories/34753http://secunia.com/advisories/34771http://secunia.com/advisories/34776http://secunia.com/advisories/34785http://secunia.com/advisories/34787http://secunia.com/advisories/34801http://secunia.com/advisories/35766http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.446399http://wiki.rpath.com/Advisories:rPSA-2009-0063http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063http://www.debian.org/security/2009/dsa-1772http://www.gentoo.org/security/en/glsa/glsa-200904-18.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:103http://www.mandriva.com/security/advisories?name=MDVSA-2009:104http://www.redhat.com/support/errata/RHSA-2009-0427.htmlhttp://www.securityfocus.com/archive/1/502752/100/0/threadedhttp://www.securityfocus.com/archive/1/504849/100/0/threadedhttp://www.securityfocus.com/bid/34536http://www.securitytracker.com/id?1022067http://www.ubuntu.com/usn/usn-758-1http://www.vmware.com/security/advisories/VMSA-2009-0009.htmlhttp://www.vupen.com/english/advisories/2009/1053http://www.vupen.com/english/advisories/2009/1865https://bugzilla.redhat.com/show_bug.cgi?id=495051https://launchpad.net/bugs/cve/2009-1185https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10925https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5975https://www.exploit-db.com/exploits/8572https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00462.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-April/msg00463.htmlhttp://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e2b362d9f23d4c63018709ab5f81a02f72b91e75http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e86a923d508c2aed371cdd958ce82489cf2ab615http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00012.htmlhttp://lists.vmware.com/pipermail/security-announce/2009/000060.htmlhttp://secunia.com/advisories/34731http://secunia.com/advisories/34750http://secunia.com/advisories/34753http://secunia.com/advisories/34771http://secunia.com/advisories/34776http://secunia.com/advisories/34785http://secunia.com/advisories/34787http://secunia.com/advisories/34801http://secunia.com/advisories/35766http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.446399http://wiki.rpath.com/Advisories:rPSA-2009-0063http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063http://www.debian.org/security/2009/dsa-1772http://www.gentoo.org/security/en/glsa/glsa-200904-18.xmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2009:103http://www.mandriva.com/security/advisories?name=MDVSA-2009:104http://www.redhat.com/support/errata/RHSA-2009-0427.htmlhttp://www.securityfocus.com/archive/1/502752/100/0/threadedhttp://www.securityfocus.com/archive/1/504849/100/0/threadedhttp://www.securityfocus.com/bid/34536http://www.securitytracker.com/id?1022067http://www.ubuntu.com/usn/usn-758-1http://www.vmware.com/security/advisories/VMSA-2009-0009.htmlhttp://www.vupen.com/english/advisories/2009/1053http://www.vupen.com/english/advisories/2009/1865https://bugzilla.redhat.com/show_bug.cgi?id=495051https://launchpad.net/bugs/cve/2009-1185https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10925https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5975https://www.exploit-db.com/exploits/8572https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00462.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-April/msg00463.html
2009-04-17
Published