CVE-2009-0834: Low severity Linux Linux kernel vulnerability
Description of problem: On x86-64, a 32-bit process (TIFIA32) can switch to 64-bit mode with ljmp, and then use the "syscall" instruction to make a 64-bit system call. A 64-bit process make a 32-bit system call with int $0x80.
In both these cases, auditsyscallentry() will use the wrong system call number table and the wrong system call argument registers. This could be used to circumvent a syscall audit configuration that filters based on the syscall numbers or argument details.
References: http://scary.beasts.org/security/CESA-2009-001.html http://scary.beasts.org/security/CESA-2009-004.html https://bugzilla.redhat.com/showbug.cgi?id=487255 http://lkml.org/lkml/2009/2/27/451 summary http://lkml.org/lkml/2009/2/27/452 syscall-audit
Other sources
The auditsyscallentry function in the Linux kernel 2.6.28.7 and earlier on the x8664 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0834?
CVE-2009-0834 has been categorized as a low-severity vulnerability.
How do I fix CVE-2009-0834?
To fix CVE-2009-0834, update your Linux kernel to a patched version beyond 2.6.28.7.
Which systems are affected by CVE-2009-0834?
CVE-2009-0834 affects various versions of Linux kernels, Debian Linux versions 4.0 and 5.0, as well as specific Ubuntu and Red Hat versions.
What type of attack does CVE-2009-0834 facilitate?
CVE-2009-0834 can potentially allow privilege escalation through improper handling of system calls.
Is there a workaround for CVE-2009-0834?
Currently, the best workaround for CVE-2009-0834 is to apply the recommended patches available for your affected systems.