CVE-2009-2287
published 2009-07-01CVE-2009-2287: The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in…
PriorityP414medium4.9CVSS 2.0
AVLACLAuNCNINAC
EPSS
0.40%
32.6th percentile
The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | >= 2.6.0 < 2.6.30 | 2.6.30 |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
vendor_ubuntu7.8HIGH
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-07-28·CVSS 7.8
CVE-2009-1389 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Michael Tokarev discovered that the RTL8169 network driver did not
correctly validate buffer sizes. A remote attacker on the local network
could send specially crafted traffic that would crash the system or
potentially grant elevated privileges. (CVE-2009-1389)
Julien Tinnes and Tavis Ormandy discovered that when executing setuid
processes the kernel did not clear certain personality flags. A local
attacker could exploit this to map the NULL memory page, causing other
vulnerabilities to become exploitable. Ubuntu 6.06 was not affected.
(CVE-2009-1895)
Matt T. Yourst discovered that KVM did not correctly validate the
page table root. A local attacker could exploit this to crash the
system, leading to a denial of s
Red Hat
kernel: KVM: x86: check for cr3 validity in ioctl_set_sregs
vendor_redhat·2009-03-15·CVSS 4.9
CVE-2009-2287 [MEDIUM] CWE-476 kernel: KVM: x86: check for cr3 validity in ioctl_set_sregs
kernel: KVM: x86: check for cr3 validity in ioctl_set_sregs
The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
Statement: Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, and 5, and Red Hat Enterprise MRG.
GHSA
GHSA-76p8-35jq-5x43: The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2
ghsa_unreviewed·2022-05-02
CVE-2009-2287 [MEDIUM] CWE-476 GHSA-76p8-35jq-5x43: The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2
The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
No detection rules found.
No public exploits indexed.
http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git%3Ba=blob%3Bf=queue-2.6.30/kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch%3Bh=b48a47dad2cf76358b327368f80c0805e6370c68%3Bhb=e7c45b24f298b5d9efd7d401150f64a1b51aaac4http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=59839dfff5eabca01cc4e20b45797a60a80af8cbhttp://secunia.com/advisories/35675http://secunia.com/advisories/36045http://secunia.com/advisories/36054http://sourceforge.net/tracker/?func=detail&atid=893831&aid=2687641&group_id=180599http://www.debian.org/security/2009/dsa-1845http://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.openwall.com/lists/oss-security/2009/06/30/1http://www.ubuntu.com/usn/usn-807-1http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git%3Ba=blob%3Bf=queue-2.6.30/kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch%3Bh=b48a47dad2cf76358b327368f80c0805e6370c68%3Bhb=e7c45b24f298b5d9efd7d401150f64a1b51aaac4http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=59839dfff5eabca01cc4e20b45797a60a80af8cbhttp://secunia.com/advisories/35675http://secunia.com/advisories/36045http://secunia.com/advisories/36054http://sourceforge.net/tracker/?func=detail&atid=893831&aid=2687641&group_id=180599http://www.debian.org/security/2009/dsa-1845http://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.openwall.com/lists/oss-security/2009/06/30/1http://www.ubuntu.com/usn/usn-807-1
2009-07-01
Published