CVE-2009-3889: Medium severity linux kernel vulnerability
Description of problem: The megaraidsas driver exposes a number of driver attributes in sysfs. Many of these are read-only, just export information from the driver and are world-readable.
A couple of attributes are writable and may be used to change the behaviour of the driver (e.g. setting debug logging levels, selecting poll vs. interrupt I/O mode etc).
Some of these writable attributes are mistakenly created with world-writable permissions, e.g. dbglvl and pollmodeio:
rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
$ grep 'DRIVERATTR.SIWUGO' drivers/scsi/megaraid/megaraidsas.c static DRIVERATTR(dbglvl, SIRUGO|SIWUGO, megasassysfsshowdbglvl, static DRIVERATTR(pollmodeio, SIRUGO|SIWUGO,
This would allow an unprivileged user to affect kernel driver behaviour and logging level.
Version-Release number of selected component (if applicable): 2.6.18-.el5
How reproducible: 100%
Steps to Reproduce: (On a system with megaraidsas loaded) 1. ls -l /sys/bus/pci/drivers/megaraidsas/dbglvl 2. ls -l /sys/bus/pci/drivers/megaraidsas/pollmodeio
Actual results: rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw-rw-rw- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
Expected results: rw------- root root /sys/bus/pci/drivers/megaraidsas/dbglvl rw------- root root /sys/bus/pci/drivers/megaraidsas/pollmodeio
Additional info:
Upstream made the dbdlvl permissions more restrictive:
commit 66dca9b8c50b5e59d3bea8b21cee5c6dae6c9c46 Author: Joe Malicki <jmalicki> Date: Thu Aug 14 17:14:48 2008 -0400
[SCSI] megaraidsas: remove sysfs dbglvl world writeable permissions /sys/bus/pci/drivers/megaraidsas/dbglvl defaults to being world-writable, which seems bad (letting any user affect kernel driver behavior and logging level). This turns off group and user write permissions, so that on typical production systems only root can write to it. [jejb: fix up rejections] Signed-off-by: Joseph Malicki <jmalicki> Acked-by: "Yang, Bo" <Bo.Yang> Signed-off-by: James Bottomley <James.Bottomley>
The pollmodeio pseudofile still has world-writable permissions upstream.
Other sources
The dbglvl file for the megaraidsas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-3889?
CVE-2009-3889 is considered a medium severity vulnerability due to its potential for unauthorized local access and manipulation of driver settings.
How do I fix CVE-2009-3889?
To fix CVE-2009-3889, update the affected Linux kernel to a version that addresses the world-writable permissions of the dbg_lvl file.
Which versions of the Linux kernel are affected by CVE-2009-3889?
CVE-2009-3889 affects Linux kernel versions prior to 2.6.27 and specific versions such as 2.6.20.6 and 2.6.24.7.
What is the impact of CVE-2009-3889 on systems?
The impact of CVE-2009-3889 includes the ability for local users to alter the behavior and logging levels of the megaraid_sas driver, which could lead to system instability.
Is CVE-2009-3889 related to driver security?
Yes, CVE-2009-3889 is related to driver security as it involves the megaraid_sas driver in the Linux kernel having insecure file permissions.