CVE-2009-4141: Use After Free

Q: What is the severity of CVE-2009-4141?

CVE-2009-4141 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution.

Q: How do I fix CVE-2009-4141?

To fix CVE-2009-4141, it is recommended to upgrade to a patched version of the Linux kernel that has addressed this vulnerability.

Q: Which versions of Linux kernel are affected by CVE-2009-4141?

CVE-2009-4141 affects multiple versions of the Linux kernel, specifically various variants of 2.6.0 up to 2.6.33.

Q: What are the implications of exploiting CVE-2009-4141?

Exploiting CVE-2009-4141 could result in an attacker gaining root privileges on the affected system.

Q: Who reported the CVE-2009-4141 vulnerability?

CVE-2009-4141 was reported by Tavis Ormandy of the Google Security Team.

Published Dec 15, 2009

Updated

Reported by Tavis Ormandy of Google Security Team. The root cause was determined to be a use-after-free of locked async file descriptors, and it is believed to have been introduced here: http://git.kernel.org/linus/233e70f4228e78eb2f80dc6650f65d3ae3dbf17c

Acknowledgements:

Red Hat would like to thank Tavis Ormandy of Google Security Team for reporting this issue.

Other sources

Use-after-free vulnerability in the fasynchelper function in fs/fcntl.c in the Linux kernel before 2.6.33-rc4-git1 allows local users to gain privileges via vectors that include enabling OASYNC (aka FASYNC or FIOASYNC) on a locked file, and then closing this file.

— MITRE

Affected Software

139 affected components

Linux Linux kernel=2.6.11

Linux Linux kernel=2.6.23.4

Linux Linux kernel=2.6.16.16

Linux Linux kernel=2.6.18.7

Linux Linux kernel=2.6.17.12

Linux Linux kernel=2.6.16.9

Linux Linux kernel=2.6.17.9

Linux Linux kernel=2.6.11.2

Linux Linux kernel=2.6.5

Linux Linux kernel=2.6.15.3

Linux Linux kernel=2.6.11.10

Linux Linux kernel=2.6.1

Linux Linux kernel=2.6.16.6

Linux Linux kernel=2.6.16.8

Linux Linux kernel=2.6.22.4

Linux Linux kernel=2.6.14.7

Linux Linux kernel=2.6.13

Linux Linux kernel=2.6.17.2

Linux Linux kernel=2.6.13.3

Linux Linux kernel<=2.6.33

Linux Linux kernel=2.6.11.8

Linux Linux kernel=2.6.23.7

Linux Linux kernel=2.6.17.8

Linux Linux kernel=2.6.14.4

Linux Linux kernel=2.6.14

Linux Linux kernel=2.6.17.4

Linux Linux kernel=2.6.16.18

Linux Linux kernel=2.6.17.14

Linux Linux kernel=2.6.10

Linux Linux kernel=2.6.14.3

Linux Linux kernel=2.6.24-rc3

Linux Linux kernel=2.6.18.3

Linux Linux kernel=2.6.11.6

Linux Linux kernel=2.6.11.11

Linux Linux kernel=2.6.16.13

Linux Linux kernel=2.6.3

Linux Linux kernel=2.6.32

Linux Linux kernel=2.6.16.4

Linux Linux kernel=2.6.17.3

Linux Linux kernel=2.6.32.3

Linux Linux kernel=2.6.22

Linux Linux kernel=2.6.4

Linux Linux kernel=2.6.16.15

Linux Linux kernel=2.6.15.6

Linux Linux kernel=2.6.24-rc5

Linux Linux kernel=2.6.15.1

Linux Linux kernel=2.6.11.5

Linux Linux kernel=2.6.18.4

Linux Linux kernel=2.6.33-rc1

Linux Linux kernel=2.6.16.1

Linux Linux kernel=2.6.18.1

Linux Linux kernel=2.6.23.1

Linux Linux kernel=2.6.2

Linux Linux kernel=2.6.14.5

Linux Linux kernel=2.6.13.2

Linux Linux kernel=2.6.17.5

Linux Linux kernel=2.6.24-rc4

Linux Linux kernel=2.6.18.5

Linux Linux kernel=2.6.13.5

Linux Linux kernel=2.6.17

Linux Linux kernel=2.6.16.11

Linux Linux kernel=2.6.16.14

Linux Linux kernel=2.6.33-rc2

Linux Linux kernel=2.6.16.25

Linux Linux kernel=2.6.16.21

Linux Linux kernel=2.6.8

Linux Linux kernel=2.6.16.28

Linux Linux kernel=2.6.17.10

Linux Linux kernel=2.6.14.1

Linux Linux kernel=2.6.16.23

Linux Linux kernel=2.6.12.5

Linux Linux kernel=2.6.15.7

Linux Linux kernel=2.6.22.7

Linux Linux kernel=2.6.16.3

Linux Linux kernel=2.6.24-rc1

Linux Linux kernel=2.6.14.6

Linux Linux kernel=2.6.12.1

Linux Linux kernel=2.6.11.9

Linux Linux kernel=2.6.17.1

Linux Linux kernel=2.6.0

Linux Linux kernel=2.6.13.4

Linux Linux kernel=2.6.23-rc2

Linux Linux kernel=2.6.22.6

Linux Linux kernel=2.6.23.3

Linux Linux kernel=2.6.18.8

Linux Linux kernel=2.6.22.3

Linux Linux kernel=2.6.12.2

Linux Linux kernel=2.6.16.31

Linux Linux kernel=2.6.16.26

Linux Linux kernel=2.6.18.2

Linux Linux kernel=2.6.16.29

Linux Linux kernel=2.6.23-rc1

Linux Linux kernel=2.6.16

Linux Linux kernel=2.6.15.2

Linux Linux kernel=2.6.16.22

Linux Linux kernel=2.6.17.11

Linux Linux kernel=2.6.16.10

Linux Linux kernel=2.6.12.4

Linux Linux kernel=2.6.11.3

Linux Linux kernel=2.6.33-rc3

Linux Linux kernel=2.6.16.24

Linux Linux kernel=2.6.23

Linux Linux kernel=2.6.12.3

Linux Linux kernel=2.6.23.2

Linux Linux kernel=2.6.7

Linux Linux kernel=2.6.32.4

Linux Linux kernel=2.6.16.30

Linux Linux kernel=2.6.15.4

Linux Linux kernel=2.6.24-rc2

Linux Linux kernel=2.6.16.17

Linux Linux kernel=2.6.16.12

Linux Linux kernel=2.6.16.27

Linux Linux kernel=2.6.12.6

Linux Linux kernel=2.6.17.7

Linux Linux kernel=2.6.11.7

Linux Linux kernel=2.6.16.2

Linux Linux kernel=2.6.18.6

Linux Linux kernel=2.6.15

Linux Linux kernel=2.6.23.5

Linux Linux kernel=2.6.32.2

Linux Linux kernel=2.6.17.6

Linux Linux kernel=2.6.23.6

Linux Linux kernel=2.6.16.7

Linux Linux kernel=2.6.32.1

Linux Linux kernel=2.6.17.13

Linux Linux kernel=2.6.22.2

Linux Linux kernel=2.6.8.1

Linux Linux kernel=2.6.22.5

Linux Linux kernel=2.6.16.5

Linux Linux kernel=2.6.11.4

Linux Linux kernel=2.6.16.19

Linux Linux kernel=2.6.11.12

Linux Linux kernel=2.6.16.20

Linux Linux kernel=2.6.15.5

Linux Linux kernel=2.6.11.1

Linux Linux kernel=2.6.9

Linux Linux kernel=2.6.13.1

Linux Linux kernel=2.6.6

Linux Linux kernel=2.6.12

Remediation

Patch Available

http://twitter.com/taviso/statuses/7744108017

Patch Available

http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.33-rc4-git1.bz2

Event History

Dec 15, 2009

Data Sourced

via Red Hat·11:48 PM

DescriptionSeverityAffected Software

Jan 19, 2010

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:30 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2009-4141?

CVE-2009-4141 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution.

How do I fix CVE-2009-4141?

To fix CVE-2009-4141, it is recommended to upgrade to a patched version of the Linux kernel that has addressed this vulnerability.

Which versions of Linux kernel are affected by CVE-2009-4141?

CVE-2009-4141 affects multiple versions of the Linux kernel, specifically various variants of 2.6.0 up to 2.6.33.

What are the implications of exploiting CVE-2009-4141?

Exploiting CVE-2009-4141 could result in an attacker gaining root privileges on the affected system.

Who reported the CVE-2009-4141 vulnerability?

CVE-2009-4141 was reported by Tavis Ormandy of the Google Security Team.

CVE-2009-4141: Use After Free

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2009-4141?

How do I fix CVE-2009-4141?

Which versions of Linux kernel are affected by CVE-2009-4141?

What are the implications of exploiting CVE-2009-4141?

Who reported the CVE-2009-4141 vulnerability?

Company

Resources

Contact