CVE-2009-1961
published 2009-06-08CVE-2009-1961: The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly…
PriorityP418medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EXPLOIT
EPSS
0.59%
44.6th percentile
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | <= 2.6.19 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.27 < 2.6.27.24 | 2.6.27.24 |
| linux | linux_kernel | >= 2.6.29 < 2.6.29.4 | 2.6.29.4 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:N/I:N/A:P
vendor_ubuntu4.9MEDIUM
vendor_redhat4.7MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-07-02·CVSS 4.9
CVE-2009-1242 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Igor Zhbanov discovered that NFS clients were able to create device nodes
even when root_squash was enabled. An authenticated remote attacker
could create device nodes with open permissions, leading to a loss of
privacy or escalation of privileges. Only Ubuntu 8.10 and 9.04 were
affected. (CVE-2009-1072)
Dan Carpenter discovered that SELinux did not correctly handle
certain network checks when running with compat_net=1. A local
attacker could exploit this to bypass network checks. Default Ubuntu
installations do not enable SELinux, and only Ubuntu 8.10 and 9.04 were
affected. (CVE-2009-1184)
Shaohua Li discovered that memory was not correctly initialized in the
AGP subsystem. A local attacker could potentially re
Red Hat
kernel: splice local denial of service
vendor_redhat·2009-04-06·CVSS 4.7
CVE-2009-1961 [MEDIUM] kernel: splice local denial of service
kernel: splice local denial of service
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.
Statement: This issue does not affect versions of Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise Linux MRG 2.
This issue was fixed in Red Hat Enterprise Linux MRG 1 via https://rhn.redhat.com/errata/RHSA-2009-1157.html.
GHSA
GHSA-53cw-7857-2j7g: The inode double locking code in fs/ocfs2/file
ghsa_unreviewed·2022-05-02
CVE-2009-1961 [LOW] CWE-362 GHSA-53cw-7857-2j7g: The inode double locking code in fs/ocfs2/file
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.
No detection rules found.
Bugzilla
CVE-2009-1961 kernel: splice local denial of service
bugzilla·2009-06-01·CVSS 4.7
CVE-2009-1961 [MEDIUM] CVE-2009-1961 kernel: splice local denial of service
CVE-2009-1961 kernel: splice local denial of service
Description of problem:
There's a possible deadlock in generic_file_splice_write(), splice_from_pipe() and ocfs2_file_splice_write():
- task A calls generic_file_splice_write()
- this calls inode_double_lock(), which locks i_mutex on both
pipe->inode and target inode
- ordering depends on inode pointers, can happen that pipe->inode is
locked first
- __splice_from_pipe() needs more data, calls pipe_wait()
- this releases lock on pipe->inode, goes to interruptible sleep
- task B calls generic_file_splice_write(), similarly to the first
- this locks pipe->inode, then tries to lock inode, but that is
already held by task A
- task A is interrupted, it tries to lock pipe->inode, but fails, as
it is already held by task B
- ABBA deadlock
Fix
arXiv
Understanding Concurrency Vulnerabilities in Linux Kernel
arxiv_fulltext·2022-12-11
Understanding Concurrency Vulnerabilities in Linux Kernel
Understanding Concurrency Vulnerabilities in Linux Kernel
Zunchen Huang
University of Southern California
Los Angeles, CA
USA
Shengjian Guo
Baidu Security
Sunnyvale, CA
USA
Meng Wu
Virginia Tech
Blacksburg, VA
USA
Chao Wang
University of Southern California
Los Angeles, CA
USA
## Abstract
While there is a large body of work on analyzing concurrency related
software bugs and developing techniques for detecting and patching
them, little attention has been given to concurrency related security
vulnerabilities. The two are different in that not all bugs are
vulnerabilities: for a bug to be exploitable, there needs be a way for
attackers to trigger its execution and cause damage, e.g., by
revealing sensitive data or running malicious code.
To fill the gap, we conduct the first empiri
CWE
Deadlock
mitre_cwe·CVSS 2.1
[LOW] CWE-833 Deadlock
CWE-833: Deadlock
The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Resource Consumption (CPU), DoS: Resource Consumption (Other), DoS: Crash, Exit, or Restart. Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done
CWE
Improper Locking
mitre_cwe
CWE-667 Improper Locking
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.
Modes of Introduction:
Phase: Architecture and Design
Phase: Implementation
Common Consequences:
Scope: A
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=7bfac9ecf0585962fe13584f5cf526d8c8e76f17http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00004.htmlhttp://secunia.com/advisories/35390http://secunia.com/advisories/35394http://secunia.com/advisories/35656http://secunia.com/advisories/35847http://secunia.com/advisories/36051http://securitytracker.com/id?1022307http://www.debian.org/security/2009/dsa-1844http://www.mandriva.com/security/advisories?name=MDVSA-2009:135http://www.mandriva.com/security/advisories?name=MDVSA-2009:148http://www.openwall.com/lists/oss-security/2009/05/29/2http://www.openwall.com/lists/oss-security/2009/05/30/1http://www.openwall.com/lists/oss-security/2009/06/02/2http://www.openwall.com/lists/oss-security/2009/06/03/1http://www.redhat.com/support/errata/RHSA-2009-1157.htmlhttp://www.securityfocus.com/bid/35143http://www.ubuntu.com/usn/usn-793-1http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=7bfac9ecf0585962fe13584f5cf526d8c8e76f17http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-07/msg00004.htmlhttp://secunia.com/advisories/35390http://secunia.com/advisories/35394http://secunia.com/advisories/35656http://secunia.com/advisories/35847http://secunia.com/advisories/36051http://securitytracker.com/id?1022307http://www.debian.org/security/2009/dsa-1844http://www.mandriva.com/security/advisories?name=MDVSA-2009:135http://www.mandriva.com/security/advisories?name=MDVSA-2009:148http://www.openwall.com/lists/oss-security/2009/05/29/2http://www.openwall.com/lists/oss-security/2009/05/30/1http://www.openwall.com/lists/oss-security/2009/06/02/2http://www.openwall.com/lists/oss-security/2009/06/03/1http://www.redhat.com/support/errata/RHSA-2009-1157.htmlhttp://www.securityfocus.com/bid/35143http://www.ubuntu.com/usn/usn-793-1
2009-06-08
Published