CVE-2009-2847: Medium severity linux kernel vulnerability
Description of problem: dosigaltstack: avoid copying 'stackt' as a structure to user space Ulrich Drepper correctly points out that there is generally padding in the structure on 64-bit hosts, and that copying the structure from kernel to user space can leak information from the kernel stack in those padding bytes. Avoid the whole issue by just copying the three members one by one instead, which also means that the function also can avoid the need for a stack frame. This also happens to match how we copy the new structure from user space, so it all even makes sense.
Upstream commit: http://git.kernel.org/linus/0083fc2c50e6c5127c2802ad323adf8143ab7856
Other sources
The dosigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-2847?
CVE-2009-2847 has a medium severity level due to potential information leakage from the kernel stack.
How do I fix CVE-2009-2847?
To fix CVE-2009-2847, update the affected Linux kernel packages to the latest versions provided by your distribution.
Which Linux kernel versions are vulnerable to CVE-2009-2847?
Linux kernel versions prior to 2.6.24.7 and 2.6.18-164.el5 are vulnerable to CVE-2009-2847.
What is the impact of exploiting CVE-2009-2847?
Exploiting CVE-2009-2847 may allow attackers to read sensitive information from the kernel stack.
Is CVE-2009-2847 specific to any Linux distributions?
Yes, CVE-2009-2847 specifically affects Red Hat Enterprise Linux 5 and similar distributions with the mentioned kernel versions.