CVE-2009-2847
published 2009-08-18CVE-2009-2847: The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear…
PriorityP418medium4.9CVSS 2.0
AVLACLAuNCCINAN
EXPLOIT
EPSS
0.94%
57.2th percentile
The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.
Affected
80 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | kernel | — | — |
| linux | kernel | — | — |
| linux | linux_kernel | <= 2.6.16.31 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:N
vendor_redhat4.9MEDIUM
vendor_ubuntu4.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
vendor_vmware·2009-11-20·CVSS 5.0
CVE-2007-2052 [MEDIUM] VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
VMSA-2009-0016: VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
a. JRE Security Update JRE update to version 1.5.0_20, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_20: CVE-2009-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-10-22·CVSS 4.4
CVE-2009-3238 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Solar Designer discovered that the z90crypt driver did not correctly
check capabilities. A local attacker could exploit this to shut down
the device, leading to a denial of service. Only affected Ubuntu 6.06.
(CVE-2009-1883)
Michael Buesch discovered that the SGI GRU driver did not correctly check
the length when setting options. A local attacker could exploit this
to write to the kernel stack, leading to root privilege escalation or
a denial of service. Only affected Ubuntu 8.10 and 9.04. (CVE-2009-2584)
It was discovered that SELinux did not fully implement the mmap_min_addr
restrictions. A local attacker could exploit this to allocate the
NULL memory page which could lead to further attacks against kernel
NULL
Red Hat
kernel: information leak in sigaltstack
vendor_redhat·2009-07-31·CVSS 4.9
CVE-2009-2847 [MEDIUM] kernel: information leak in sigaltstack
kernel: information leak in sigaltstack
The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.
Statement: This issue is not planned to be fixed in Red Hat Enterprise Linux 3, due to this product being in Production 3 of its maintenance life-cycle, where only qualified security errata of important or critical impact are addressed. For further information about Errata Support Policy, visit: https://access.redhat.com/support/policy/updates/errata/
GHSA
GHSA-c85v-8h9f-3jwr: The do_sigaltstack function in kernel/signal
ghsa_unreviewed·2022-05-02
CVE-2009-2847 [MEDIUM] GHSA-c85v-8h9f-3jwr: The do_sigaltstack function in kernel/signal
The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.
No detection rules found.
arXiv
NIFuzz: Estimating Quantified Information Flow with a Fuzzer
arxiv_fulltext·2025-01-24
NIFuzz: Estimating Quantified Information Flow with a Fuzzer
NIFuzz: Estimating Quantified Information Flow with a Fuzzer
Daniel Blackwell
[email protected]
0000-0001-7320-9057
University College London
London
UK
Ingolf Becker
[email protected]
0000-0002-3963-4743
University College London
London
UK
David Clark
[email protected]
0000-0002-7004-934X
University College London
London
UK
## Abstract
This paper presents a scalable, practical approach to quantifying information leaks in software; these errors are often overlooked and downplayed, but can seriously compromise security mechanisms such as address space layout randomisation (ASLR) and Pointer Authentication (PAC). We introduce approaches for three different metrics to estimate the size of information leaks, including a new derivation for the calculation of conditional
arXiv
Timeloops: Automatic System Call Policy Learning for Containerized Microservices
arxiv_fulltext·2022-09-26
Timeloops: Automatic System Call Policy Learning for Containerized Microservices
Meghna Pancholi
[email protected]
Columbia University
Andreas D. Kellas
[email protected]
Columbia University
Vasileios P. Kemerlis
[email protected]
Brown University
Simha Sethumadhavan
[email protected]
Columbia University
## Abstract
We introduce , a novel technique for automatically learning system
call filtering policies for containerized microservices applications. At
run-time, automatically learns which system calls a program should
be allowed to invoke, while rejecting attempts to call spurious system calls.
Further, addresses many of the shortcomings of state-of-the-art
static analysis-based techniques, such as the ability to generate tight filters
for programs written in interpreted languages such as PHP, Python, and
JavaScript. has a simple and rob
arXiv
Threat Modeling and Security Analysis of Containers: A Survey
arxiv_fulltext·2021-11-22
Threat Modeling and Security Analysis of Containers: A Survey
Threat Modeling and Security Analysis of Containers: A Survey
Ann Yi Wong1 Eyasu Getahun Chekole1 Mart\'in Ochoa2 Jianying Zhou1
Singapore University of Technology and Design, Singapore 487372, Singapore
[email protected], \eyasu_chekole, jianying_zhou\@sutd.edu.sg
Department of Computer Science, ETH Zurich, 8092 Zurich, Switzerland
[email protected]
## Abstract
Traditionally, applications that are used in large and small enterprises were deployed on ``bare metal'' servers installed with operating systems. Recently, the use of multiple virtual machines (VMs) on the same physical server was adopted due to cost reduction and flexibility. Nowadays, containers have become popular for application deployment due to smaller footprints than the VMs, their ability to start
Bugzilla
CVE-2009-2847 kernel: information leak in sigaltstack
bugzilla·2009-08-04·CVSS 4.9
CVE-2009-2847 [MEDIUM] CVE-2009-2847 kernel: information leak in sigaltstack
CVE-2009-2847 kernel: information leak in sigaltstack
Description of problem:
do_sigaltstack: avoid copying 'stack_t' as a structure to user space
Ulrich Drepper correctly points out that there is generally padding in the structure on 64-bit hosts, and that copying the structure from kernel to user space can leak information from the kernel stack in those padding bytes.
Avoid the whole issue by just copying the three members one by one instead, which also means that the function also can avoid the need for a stack frame. This also happens to match how we copy the new structure from user space, so it all even makes sense.
Upstream commit:
http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856
Discussion:
Reproducer:
http://milw0rm.com/exploits/9352
---
MITRE's CVE-2009
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=0083fc2c50e6c5127c2802ad323adf8143ab7856http://rhn.redhat.com/errata/RHSA-2009-1243.htmlhttp://secunia.com/advisories/36136http://secunia.com/advisories/36501http://secunia.com/advisories/36562http://secunia.com/advisories/36759http://secunia.com/advisories/37105http://secunia.com/advisories/37471http://www.exploit-db.com/exploits/9352http://www.openwall.com/lists/oss-security/2009/08/04/1http://www.openwall.com/lists/oss-security/2009/08/05/1http://www.openwall.com/lists/oss-security/2009/08/26/2http://www.redhat.com/support/errata/RHSA-2009-1438.htmlhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.ubuntu.com/usn/USN-852-1http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/3316https://bugzilla.redhat.com/show_bug.cgi?id=515392https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10637https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8405https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01256.htmlhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=0083fc2c50e6c5127c2802ad323adf8143ab7856http://rhn.redhat.com/errata/RHSA-2009-1243.htmlhttp://secunia.com/advisories/36136http://secunia.com/advisories/36501http://secunia.com/advisories/36562http://secunia.com/advisories/36759http://secunia.com/advisories/37105http://secunia.com/advisories/37471http://www.exploit-db.com/exploits/9352http://www.openwall.com/lists/oss-security/2009/08/04/1http://www.openwall.com/lists/oss-security/2009/08/05/1http://www.openwall.com/lists/oss-security/2009/08/26/2http://www.redhat.com/support/errata/RHSA-2009-1438.htmlhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.ubuntu.com/usn/USN-852-1http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/3316https://bugzilla.redhat.com/show_bug.cgi?id=515392https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10637https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8405https://www.redhat.com/archives/fedora-package-announce/2009-August/msg01256.html
2009-08-18
Published