CVE-2009-2910: Infoleak
arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x8664 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.
Other sources
Created attachment 363386 [details] Upstream patch
An information leak was discovered in the kernel where a 32-bit process running in 64-bit mode could possibly read certain 64 bit registers. Quoting the upstream commit: http://lkml.org/lkml/2009/10/1/164
x86: Don't leak 64-bit kernel register values to 32-bit processes
While 32-bit processes can't directly access R8...R15, they can gain access to these registers by temporarily switching themselves into 64-bit mode.
Therefore, registers not preserved anyway by called C functions (i.e. R8...R11) must be cleared prior to returning to user mode.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2910?
CVE-2009-2910 has been classified as a medium severity vulnerability.
How does CVE-2009-2910 affect the Linux kernel?
CVE-2009-2910 allows local users to read register values from an earlier process after switching from an ia32 process to 64-bit mode.
How do I fix CVE-2009-2910?
To fix CVE-2009-2910, upgrade the affected Linux kernel to version 2.6.31.4 or later.
Which versions of Linux are affected by CVE-2009-2910?
CVE-2009-2910 affects various versions of the Linux kernel prior to 2.6.31.4, including certain versions of SUSE and Ubuntu.
Can CVE-2009-2910 be exploited remotely?
CVE-2009-2910 is a local privilege escalation vulnerability, meaning it can only be exploited from user level.