National Cyber-Alert System

Vulnerability Summary for CVE-2009-0676

Overview

The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel memory via an SO_BSDCOMPAT getsockopt request.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 33846

Type: Patch Information

Hyperlink:http://www.securityfocus.com/bid/33846

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=486305

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=486305

External Source: XF

Name: kernel-sock-information-disclosure(48847)

Hyperlink:http://xforce.iss.net/xforce/xfdb/48847

External Source: UBUNTU

Name: USN-751-1

Hyperlink:http://www.ubuntu.com/usn/usn-751-1

External Source: REDHAT

Name: RHSA-2009:0360

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-0360.html

External Source: REDHAT

Name: RHSA-2009:0326

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-0326.html

External Source: MLIST

Name: [oss-security] 20090302 Re: CVE request: kernel: memory disclosure in SO_BSDCOMPAT gsopt

Hyperlink:http://www.openwall.com/lists/oss-security/2009/03/02/6

External Source: MLIST

Name: [oss-security] 20090224 Re: CVE request: kernel: memory disclosure in SO_BSDCOMPAT gsopt

Hyperlink:http://www.openwall.com/lists/oss-security/2009/02/24/1

External Source: MANDRIVA

Name: MDVSA-2009:071

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:071

External Source: CONFIRM

Name: http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.6

Hyperlink:http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.6

External Source: DEBIAN

Name: DSA-1794

Hyperlink:http://www.debian.org/security/2009/dsa-1794

External Source: DEBIAN

Name: DSA-1787

Hyperlink:http://www.debian.org/security/2009/dsa-1787

External Source: DEBIAN

Name: DSA-1749

Hyperlink:http://www.debian.org/security/2009/dsa-1749

External Source: SECUNIA

Name: 35394

Hyperlink:http://secunia.com/advisories/35394

External Source: SECUNIA

Name: 35390

Hyperlink:http://secunia.com/advisories/35390

External Source: SECUNIA

Name: 35011

Hyperlink:http://secunia.com/advisories/35011

External Source: SECUNIA

Name: 34981

Hyperlink:http://secunia.com/advisories/34981

External Source: SECUNIA

Name: 34962

Hyperlink:http://secunia.com/advisories/34962

External Source: SECUNIA

Name: 34786

Hyperlink:http://secunia.com/advisories/34786

External Source: SECUNIA

Name: 34680

Hyperlink:http://secunia.com/advisories/34680

External Source: SECUNIA

Name: 34502

Hyperlink:http://secunia.com/advisories/34502

External Source: SECUNIA

Name: 34394

Hyperlink:http://secunia.com/advisories/34394

External Source: SECUNIA

Name: 33758

Hyperlink:http://secunia.com/advisories/33758

External Source: REDHAT

Name: RHSA-2009:0459

Hyperlink:http://rhn.redhat.com/errata/RHSA-2009-0459.html

External Source: CONFIRM

Name: http://patchwork.kernel.org/patch/6816/

Hyperlink:http://patchwork.kernel.org/patch/6816/

External Source: MLIST

Name: [oss-security] 20090220 CVE request: kernel: memory disclosure in SO_BSDCOMPAT gsopt

Hyperlink:http://openwall.com/lists/oss-security/2009/02/20/1

External Source: MLIST

Name: [linux-kernel] 20090223 net: amend the fix for SO_BSDCOMPAT gsopt infoleak

Hyperlink:http://marc.info/?l=linux-kernel&m=123540732700371&w=2

External Source: MLIST

Name: [linux-kernel] 20090212 [PATCH] 4 bytes kernel memory disclosure in SO_BSDCOMPAT gsopt try #2

Hyperlink:http://lkml.org/lkml/2009/2/12/123

External Source: SUSE

Name: SUSE-SA:2009:031

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html

External Source: SUSE

Name: SUSE-SA:2009:030

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html

External Source: SUSE

Name: SUSE-SA:2009:021

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.html

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=df0bca049d01c0ee94afb7cd5dfd959541e6c8da

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=df0bca049d01c0ee94afb7cd5dfd959541e6c8da