Skip to content
OpenAdvisories
Unscored CVE-2009-2695 EUVD-2009-2687GHSA-jh8r-4ff3-92j9

The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which al…

Published Aug 28, 2009 · Updated Aug 7, 2024 · Assigned by mitre

Description

The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 5.0 linux-2.6 2.6.26-19lenny1 DSA-1915-1
Debian 4.0 linux-2.6.24 2.6.24-6~etchnhalf.9etch3 DSA-2005-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 5 kernel +12 2.6.18-164.6.1.el5 RHSA-2009:1548
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 5.3 EUS kernel +12 2.6.18-128.11.1.el5 RHSA-2009:1587
RHEL 5.2 EUS kernel +12 2.6.18-92.1.32.el5 RHSA-2009:1672
Red Hat MRG 1 kernel-rt +9 2.6.24.7-137.el5rt RHSA-2009:1540

Advisories 6

References