CVE-2009-1895
UnknownEPSS 0.44%
Last modified
CVE-2009-1895 is a vulnerability of currently unknown severity. The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | <= 2.6.31 | — |
| Linux | Linux Kernel | 2.6.31 | Rc1 |
| Debian | Debian Linux | 4.0 | — |
| Debian | Debian Linux | 5.0 | — |
| Canonical | Ubuntu Linux | 6.06 | — |
| Canonical | Ubuntu Linux | 8.04 | — |
| Canonical | Ubuntu Linux | 8.10 | — |
| Canonical | Ubuntu Linux | 9.04 | — |
References
- http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.htmlPatch, Third Party Advisory
- http://patchwork.kernel.org/patch/32598/Patch, Vendor Advisory
- http://secunia.com/advisories/35801Third Party Advisory
- http://secunia.com/advisories/36045Third Party Advisory
- http://secunia.com/advisories/36051Third Party Advisory
- http://secunia.com/advisories/36054Third Party Advisory
- http://secunia.com/advisories/36116Third Party Advisory
- http://secunia.com/advisories/36131Third Party Advisory
- http://secunia.com/advisories/36759Third Party Advisory
- http://secunia.com/advisories/37471Third Party Advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0111Third Party Advisory
- http://www.debian.org/security/2009/dsa-1844Third Party Advisory
- http://www.debian.org/security/2009/dsa-1845Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:051Third Party Advisory
- http://www.osvdb.org/55807Broken Link
- http://www.redhat.com/support/errata/RHSA-2009-1193.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1438.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/505254/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/507985/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/512019/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/35647Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-807-1Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlThird Party Advisory
- http://www.vupen.com/english/advisories/2009/1866Patch, Third Party Advisory
- http://www.vupen.com/english/advisories/2009/3316Third Party Advisory
- https://bugs.launchpad.net/bugs/cve/2009-1895Third Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1540.htmlThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1550.htmlThird Party Advisory
- http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.htmlPatch, Third Party Advisory
- http://patchwork.kernel.org/patch/32598/Patch, Vendor Advisory
- http://secunia.com/advisories/35801Third Party Advisory
- http://secunia.com/advisories/36045Third Party Advisory
- http://secunia.com/advisories/36051Third Party Advisory
- http://secunia.com/advisories/36054Third Party Advisory
- http://secunia.com/advisories/36116Third Party Advisory
- http://secunia.com/advisories/36131Third Party Advisory
- http://secunia.com/advisories/36759Third Party Advisory
- http://secunia.com/advisories/37471Third Party Advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0111Third Party Advisory
- http://www.debian.org/security/2009/dsa-1844Third Party Advisory
- http://www.debian.org/security/2009/dsa-1845Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:051Third Party Advisory
- http://www.osvdb.org/55807Broken Link
- http://www.redhat.com/support/errata/RHSA-2009-1193.htmlThird Party Advisory
- http://www.redhat.com/support/errata/RHSA-2009-1438.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/505254/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/507985/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/512019/100/0/threadedThird Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/35647Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-807-1Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlThird Party Advisory
- http://www.vupen.com/english/advisories/2009/1866Patch, Third Party Advisory
- http://www.vupen.com/english/advisories/2009/3316Third Party Advisory
- https://bugs.launchpad.net/bugs/cve/2009-1895Third Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1540.htmlThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1550.htmlThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-1895?
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).
How severe is CVE-2009-1895?
Severity scoring for CVE-2009-1895 is pending analysis. The EPSS model estimates a 0.44% probability of exploitation in the next 30 days.
How do I fix CVE-2009-1895?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-1889The OSCAR protocol implementation in Pidgin before 2.5.8 mis…
- CVE-2009-1890The stream_reqbody_cl function in mod_proxy_http.c in the mo…
- CVE-2009-1891The mod_deflate module in Apache httpd 2.2.11 and earlier co…
- CVE-2009-1892dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-iden…
- CVE-2009-1893The configtest function in the Red Hat dhcpd init script for…
- CVE-2009-1894Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allow…
- CVE-2009-1896The Java Web Start framework in IcedTea in OpenJDK before 1.…
- CVE-2009-1897The tun_chr_poll function in drivers/net/tun.c in the tun su…
- CVE-2009-1898The secure login page in the Administrative Console componen…
- CVE-2009-1899Unspecified vulnerability in the Administrative Configservic…
- CVE-2009-1900The Configservice APIs in the Administrative Console compone…
- CVE-2009-1901The Security component in IBM WebSphere Application Server (…
Are you affected by CVE-2009-1895?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST