CVE-2009-3001: Infoleak
First published: Sun Aug 23 2009(Updated: )
Description of problem: 1) NET: llc, zero sockaddr_llc struct sllc_arphrd member of sockaddr_llc might not be changed. Zero sllc before copying to the above layer's structure. <a href="http://git.kernel.org/linus/3480c63bdf008e9289aab94418f43b9592978fff">http://git.kernel.org/linus/3480c63bdf008e9289aab94418f43b9592978fff</a> <a href="http://git.kernel.org/linus/28e9fc592cb8c7a43e4d3147b38be6032a0e81bc">http://git.kernel.org/linus/28e9fc592cb8c7a43e4d3147b38be6032a0e81bc</a> <a href="http://milw0rm.com/exploits/9513">http://milw0rm.com/exploits/9513</a> Note that LLC sockets are restricted to root since v2.6.25-rc9 (see commit 3480c63b). 2) can: Fix raw_getname() leak raw_getname() can leak 10 bytes of kernel memory to user <a href="http://git.kernel.org/linus/e84b90ae5eb3c112d1f208964df1d8156a538289">http://git.kernel.org/linus/e84b90ae5eb3c112d1f208964df1d8156a538289</a> Note that this was introduced in v2.6.25-rc1. 3) irda: Fix irda_getname() leak irda_getname() can leak kernel memory to user. <a href="http://git.kernel.org/linus/09384dfc76e526c3993c09c42e016372dc9dd22c">http://git.kernel.org/linus/09384dfc76e526c3993c09c42e016372dc9dd22c</a> 4) appletalk: fix atalk_getname() leak atalk_getname() can leak 8 bytes of kernel memory to user <a href="http://git.kernel.org/linus/3d392475c873c10c10d6d96b94d092a34ebd4791">http://git.kernel.org/linus/3d392475c873c10c10d6d96b94d092a34ebd4791</a> <a href="http://milw0rm.com/exploits/9521">http://milw0rm.com/exploits/9521</a> 5) netrom: Fix nr_getname() leak nr_getname() can leak kernel memory to user. <a href="http://git.kernel.org/linus/f6b97b29513950bfbf621a83d85b6f86b39ec8db">http://git.kernel.org/linus/f6b97b29513950bfbf621a83d85b6f86b39ec8db</a> 6) econet: Fix econet_getname() leak econet_getname() can leak kernel memory to user. <a href="http://git.kernel.org/linus/80922bbb12a105f858a8f0abb879cb4302d0ecaa">http://git.kernel.org/linus/80922bbb12a105f858a8f0abb879cb4302d0ecaa</a> 7) rose: Fix rose_getname() leak rose_getname() can leak kernel memory to user. <a href="http://git.kernel.org/linus/17ac2e9c58b69a1e25460a568eae1b0dc0188c25">http://git.kernel.org/linus/17ac2e9c58b69a1e25460a568eae1b0dc0188c25</a> CVE request: <a href="http://article.gmane.org/gmane.comp.security.oss.general/2029">http://article.gmane.org/gmane.comp.security.oss.general/2029</a> <a href="http://article.gmane.org/gmane.comp.security.oss.general/2033">http://article.gmane.org/gmane.comp.security.oss.general/2033</a>
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | =2.6.31-rc4 | |
| Linux Linux kernel | =2.6.31-rc1 | |
| Linux Linux kernel | =2.6.31-rc6 | |
| Linux Linux kernel | =2.6.31-rc5 | |
| Linux Linux kernel | =2.6.31-rc3 | |
| Linux Linux kernel | =2.6.31-rc2 | |
| Linux Linux kernel | =2.6.31 | |
| Linux Linux kernel | <2.6.31 | |
| Canonical Ubuntu Linux | =6.06 | |
| Canonical Ubuntu Linux | =9.04 | |
| Canonical Ubuntu Linux | =8.04 | |
| Canonical Ubuntu Linux | =8.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=28e9fc592cb8c7a43e4d3147b38be6032a0e81bc
- http://jon.oberheide.org/files/llc-getsockname-leak.c
- http://secunia.com/advisories/37105
- http://www.exploit-db.com/exploits/9513
- http://www.openwall.com/lists/oss-security/2009/08/26/1
- http://www.securityfocus.com/bid/36126
- http://www.ubuntu.com/usn/USN-852-1
- https://bugzilla.redhat.com/show_bug.cgi?id=519305
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52732
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=28e9fc592cb8c7a43e4d3147b38be6032a0e81bc
- http://git.kernel.org/linus/3480c63bdf008e9289aab94418f43b9592978fff
- http://git.kernel.org/linus/28e9fc592cb8c7a43e4d3147b38be6032a0e81bc
- http://milw0rm.com/exploits/9513
- http://git.kernel.org/linus/e84b90ae5eb3c112d1f208964df1d8156a538289
- http://git.kernel.org/linus/09384dfc76e526c3993c09c42e016372dc9dd22c
- http://git.kernel.org/linus/3d392475c873c10c10d6d96b94d092a34ebd4791
- http://milw0rm.com/exploits/9521
- http://git.kernel.org/linus/f6b97b29513950bfbf621a83d85b6f86b39ec8db
- http://git.kernel.org/linus/80922bbb12a105f858a8f0abb879cb4302d0ecaa
- http://git.kernel.org/linus/17ac2e9c58b69a1e25460a568eae1b0dc0188c25
- http://article.gmane.org/gmane.comp.security.oss.general/2029
- http://article.gmane.org/gmane.comp.security.oss.general/2033
- https://access.redhat.com/security/cve/CVE-2009-3001
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3001
- http://www.milw0rm.com/exploits/9513
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=519305
- http://xforce.iss.net/xforce/xfdb/52732
- https://access.redhat.com/security/cve/CVE-2009-3002
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3002
- http://www.milw0rm.com/exploits/9521
- http://www.openwall.com/lists/oss-security/2009/08/27/1
- http://www.openwall.com/lists/oss-security/2009/08/27/2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=09384dfc76e526c3993c09c42e016372dc9dd22c
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=17ac2e9c58b69a1e25460a568eae1b0dc0188c25
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3d392475c873c10c10d6d96b94d092a34ebd4791
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=80922bbb12a105f858a8f0abb879cb4302d0ecaa
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e84b90ae5eb3c112d1f208964df1d8156a538289
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f6b97b29513950bfbf621a83d85b6f86b39ec8db
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc7
- http://www.securityfocus.com/bid/36150
- http://secunia.com/advisories/36438
- http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3001
- http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002
- http://admin.fedoraproject.org/updates/kernel-2.6.27.35-170.2.94.fc10
- https://rhn.redhat.com/errata/RHSA-2009-1540.html
- https://rhn.redhat.com/errata/RHSA-2009-1550.html
- https://www.cve.org/CVERecord?id=CVE-2009-3001 https://nvd.nist.gov/vuln/detail/CVE-2009-3001
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3001.json
- collector/nvd-historical
- collector/nvd-index
- collector/nvd-api
- agent/type
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-3001
- collector/redhat-cve
- agent/first-publish-date
- agent/references
- agent/tags
- agent/severity
- agent/weakness
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/2.6.31-rc4
- version/linux linux kernel/2.6.31-rc1
- version/linux linux kernel/2.6.31-rc6
- version/linux linux kernel/2.6.31-rc5
- version/linux linux kernel/2.6.31-rc3
- version/linux linux kernel/2.6.31-rc2
- version/linux linux kernel/2.6.31
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/6.06
- version/canonical ubuntu linux/9.04
- version/canonical ubuntu linux/8.04
- version/canonical ubuntu linux/8.10