CVE-2009-2911: Low severity red hat systemtap-sdt-devel vulnerability
Multiple denial of service flaws were found in the SystemTap instrumentation system, when the --unprivileged mode was activated:
a, Kernel stack overflow allows local attackers to cause denial of service or execute arbitrary code via long number of parameters, provided to the print call.
b, Kernel stack frame overflow allows local attackers to cause denial of service via specially-crafted user-provided DWARF information.
c, Absent check(s) for the upper bound of the size of the unwind table and for the upper bound of the size of each of the CIE/CFI records, could allow an attacker to cause a denial of service (infinite loop).
References: ----------- http://sources.redhat.com/bugzilla/showbug.cgi?id=10750 http://gcc.gnu.org/bugzilla/showbug.cgi?id=41633
Issue severity note: -------------------- The --unprivileged mode needs to be activated by the privileged user prior the unprivileged user could exploit these flaws.
SystemTap 1.0 in the default configuration is not shipped with the --unprivileged mode activated, this is NOT vulnerable to these flaws.
Information about vulnerable versions: -------------------------------------- These issues do NOT affect the versions of SystemTap instrumentation system, as shipped with Red Hat Enterprise Linux 4 and 5.
These issues affect the versions of SystemTap instrumentation system, as shipped with Fedora releases of 10 and 11. See also above severity note.
Other sources
SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow, or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables, related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2911?
CVE-2009-2911 is classified as a denial of service vulnerability that may allow local attackers to disrupt system operations.
How do I fix CVE-2009-2911?
To address CVE-2009-2911, it is recommended to update to a patched version of SystemTap that resolves these denial of service flaws.
What software is affected by CVE-2009-2911?
CVE-2009-2911 affects SystemTap version 1.0 when the --unprivileged mode is activated.
What types of attacks are possible due to CVE-2009-2911?
CVE-2009-2911 can lead to denial of service attacks or potentially allow the execution of arbitrary code by local attackers.
Is CVE-2009-2911 exploitable remotely?
CVE-2009-2911 is not remotely exploitable as it requires local access to the affected system.