National Cyber-Alert System

Vulnerability Summary for CVE-2009-0834

Overview

The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=487990

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=487990

External Source: XF

Name: linux-kernel-auditsyscallentry-sec-bypass(49061)

Hyperlink:http://xforce.iss.net/xforce/xfdb/49061

External Source: UBUNTU

Name: USN-751-1

Hyperlink:http://www.ubuntu.com/usn/usn-751-1

External Source: SECTRACK

Name: 1022153

Hyperlink:http://www.securitytracker.com/id?1022153

External Source: BID

Name: 33951

Hyperlink:http://www.securityfocus.com/bid/33951

External Source: BUGTRAQ

Name: 20090516 rPSA-2009-0084-1 kernel

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/503610/100/0/threaded

External Source: REDHAT

Name: RHSA-2009:0451

Hyperlink:http://www.redhat.com/support/errata/RHSA-2009-0451.html

External Source: MANDRIVA

Name: MDVSA-2009:118

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2009:118

External Source: DEBIAN

Name: DSA-1800

Hyperlink:http://www.debian.org/security/2009/dsa-1800

External Source: DEBIAN

Name: DSA-1794

Hyperlink:http://www.debian.org/security/2009/dsa-1794

External Source: DEBIAN

Name: DSA-1787

Hyperlink:http://www.debian.org/security/2009/dsa-1787

External Source: CONFIRM

Name: http://wiki.rpath.com/Advisories:rPSA-2009-0084

Hyperlink:http://wiki.rpath.com/Advisories:rPSA-2009-0084

External Source: SECUNIA

Name: 35394

Hyperlink:http://secunia.com/advisories/35394

External Source: SECUNIA

Name: 35390

Hyperlink:http://secunia.com/advisories/35390

External Source: SECUNIA

Name: 35185

Hyperlink:http://secunia.com/advisories/35185

External Source: SECUNIA

Name: 35121

Hyperlink:http://secunia.com/advisories/35121

External Source: SECUNIA

Name: 35120

Hyperlink:http://secunia.com/advisories/35120

External Source: SECUNIA

Name: 35015

Hyperlink:http://secunia.com/advisories/35015

External Source: SECUNIA

Name: 35011

Hyperlink:http://secunia.com/advisories/35011

External Source: SECUNIA

Name: 34981

Hyperlink:http://secunia.com/advisories/34981

External Source: SECUNIA

Name: 34962

Hyperlink:http://secunia.com/advisories/34962

External Source: SECUNIA

Name: 34917

Hyperlink:http://secunia.com/advisories/34917

External Source: SECUNIA

Name: 34084

Type: Advisory

Hyperlink:http://secunia.com/advisories/34084

External Source: MISC

Name: http://scary.beasts.org/security/CESA-2009-001.html

Hyperlink:http://scary.beasts.org/security/CESA-2009-001.html

External Source: REDHAT

Name: RHSA-2009:0473

Hyperlink:http://rhn.redhat.com/errata/RHSA-2009-0473.html

External Source: REDHAT

Name: RHSA-2009:0459

Hyperlink:http://rhn.redhat.com/errata/RHSA-2009-0459.html

External Source: MLIST

Name: [oss-security] 20090302 CVE request: kernel: x86-64: syscall-audit: 32/64 syscall hole

Hyperlink:http://marc.info/?l=oss-security&m=123597642832637&w=2

External Source: MLIST

Name: [linux-kernel] 20090228 [PATCH 1/2] x86-64: syscall-audit: fix 32/64 syscall hole

Hyperlink:http://marc.info/?l=linux-kernel&m=123579065130246&w=2

External Source: MLIST

Name: [linux-kernel] 20090228 [PATCH 0/2] x86-64: 32/64 syscall arch holes

Hyperlink:http://marc.info/?l=linux-kernel&m=123579056530191&w=2

External Source: SUSE

Name: SUSE-SA:2009:031

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html

External Source: SUSE

Name: SUSE-SA:2009:030

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html

External Source: SUSE

Name: SUSE-SA:2009:028

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ccbe495caa5e604b04d5a31d7459a6f6a76a756c

Type: Advisory

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ccbe495caa5e604b04d5a31d7459a6f6a76a756c