CVE-2009-2793: Medium severity netbsd current vulnerability
Published Sep 18, 2009
·Updated
The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment limits.
Affected Software
30 affected components
NetBSD NetBSD<=5.0.1
NetBSD NetBSD=0.8
NetBSD NetBSD=0.9
NetBSD NetBSD=1.0
NetBSD NetBSD=1.1
NetBSD NetBSD=1.2
NetBSD NetBSD=1.2.1
NetBSD NetBSD=1.3
NetBSD NetBSD=1.3.1
NetBSD NetBSD=1.3.2
NetBSD NetBSD=1.3.3
NetBSD NetBSD=1.5
NetBSD NetBSD=1.5.1
NetBSD NetBSD=1.5.2
NetBSD NetBSD=1.5.3
NetBSD NetBSD=1.6
NetBSD NetBSD=1.6.1
NetBSD NetBSD=1.6.2
NetBSD NetBSD=2.0
NetBSD NetBSD=2.0.1
NetBSD NetBSD=2.0.2
NetBSD NetBSD=2.0.3
NetBSD NetBSD=2.1
NetBSD NetBSD=3.0
NetBSD NetBSD=3.0.1
NetBSD NetBSD=3.0.2
NetBSD NetBSD=3.1
NetBSD NetBSD=4.0
NetBSD NetBSD=4.0.1
NetBSD NetBSD=5.0
Event History
Sep 18, 2009
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2793?
CVE-2009-2793 has a moderate severity level due to the potential for privilege escalation.
2
How do I fix CVE-2009-2793?
To fix CVE-2009-2793, upgrade to a version of NetBSD later than 5.0.1.
3
Which versions of NetBSD are affected by CVE-2009-2793?
CVE-2009-2793 affects NetBSD versions 5.0.1 and earlier, as well as versions from 0.8 to 5.0.
4
Can CVE-2009-2793 be exploited remotely?
CVE-2009-2793 is classified as a local vulnerability, meaning it requires local access to exploit.
5
What type of vulnerability is CVE-2009-2793?
CVE-2009-2793 is a privilege escalation vulnerability stemming from improper handling of the iret instruction.