CVE-2009-4141

Severity

72%

Complexity

39%

Confidentiality

165%

Per: http://cwe.mitre.org/data/definitions/416.html CWE-416: Use After Free

Use-after-free vulnerability in the fasync_helper function in fs/fcntl.c in the Linux kernel before 2.6.33-rc4-git1 allows local users to gain privileges via vectors that include enabling O_ASYNC (aka FASYNC or FIOASYNC) on a locked file, and then closing this file.

Per: http://cwe.mitre.org/data/definitions/416.html CWE-416: Use After Free

CVSS 2.0 Base Score 7.2. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:C/I:C/A:C).

Overview

Type

Linux Kernel

First reported 15 years ago

2010-01-19 16:30:00

Last updated 7 years ago

2017-09-19 01:29:00

Affected Software

Linux Kernel 2.6.0

2.6.0

Linux Kernel 2.6.1

2.6.1

Linux Kernel 2.6.2

2.6.2

Linux Kernel 2.6.3

2.6.3

Linux Kernel 2.6.4

2.6.4

Linux Kernel 2.6.5

2.6.5

Linux Kernel 2.6.6

2.6.6

Linux Kernel 2.6.7

2.6.7

Linux Kernel 2.6.8

2.6.8

Linux Kernel 2.6.8.1

2.6.8.1

Linux Kernel 2.6.9

2.6.9

Linux Kernel 2.6.10

2.6.10

Linux Kernel 2.6.11

2.6.11

Linux Kernel 2.6.11.1

2.6.11.1

Linux Kernel 2.6.11.2

2.6.11.2

Linux Kernel 2.6.11.3

2.6.11.3

Linux Kernel 2.6.11.4

2.6.11.4

Linux Kernel 2.6.11.5

2.6.11.5

Linux Kernel 2.6.11.6

2.6.11.6

Linux Kernel 2.6.11.7

2.6.11.7

Linux Kernel 2.6.11.8

2.6.11.8

Linux Kernel 2.6.11.9

2.6.11.9

Linux Kernel 2.6.11.10

2.6.11.10

Linux Kernel 2.6.11.11

2.6.11.11

Linux Kernel 2.6.11.12

2.6.11.12

Linux Kernel 2.6.12

2.6.12

Linux Kernel 2.6.12.1

2.6.12.1

Linux Kernel 2.6.12.2

2.6.12.2

Linux Kernel 2.6.12.3

2.6.12.3

Linux Kernel 2.6.12.4

2.6.12.4

Linux Kernel 2.6.12.5

2.6.12.5

Linux Kernel 2.6.12.6

2.6.12.6

Linux Kernel 2.6.13

2.6.13

Linux Kernel 2.6.13.1

2.6.13.1

Linux Kernel 2.6.13.2

2.6.13.2

Linux Kernel 2.6.13.3

2.6.13.3

Linux Kernel 2.6.13.4

2.6.13.4

Linux Kernel 2.6.13.5

2.6.13.5

Linux Kernel 2.6.14

2.6.14

Linux Kernel 2.6.14.1

2.6.14.1

Linux Kernel 2.6.14.3

2.6.14.3

Linux Kernel 2.6.14.4

2.6.14.4

Linux Kernel 2.6.14.5

2.6.14.5

Linux Kernel 2.6.14.6

2.6.14.6

Linux Kernel 2.6.14.7

2.6.14.7

Linux Kernel 2.6.15

2.6.15

Linux Kernel 2.6.15.1

2.6.15.1

Linux Kernel 2.6.15.2

2.6.15.2

Linux Kernel 2.6.15.3

2.6.15.3

Linux Kernel 2.6.15.4

2.6.15.4

Linux Kernel 2.6.15.5

2.6.15.5

Linux Kernel 2.6.15.6

2.6.15.6

Linux Kernel 2.6.15.7

2.6.15.7

Linux Kernel 2.6.16

2.6.16

Linux Kernel 2.6.16.1

2.6.16.1

Linux Kernel 2.6.16.2

2.6.16.2

Linux Kernel 2.6.16.3

2.6.16.3

Linux Kernel 2.6.16.4

2.6.16.4

Linux Kernel 2.6.16.5

2.6.16.5

Linux Kernel 2.6.16.6

2.6.16.6

Linux Kernel 2.6.16.7

2.6.16.7

Linux Kernel 2.6.16.8

2.6.16.8

Linux Kernel 2.6.16.9

2.6.16.9

Linux Kernel 2.6.16.10

2.6.16.10

Linux Kernel 2.6.16.11

2.6.16.11

Linux Kernel 2.6.16.12

2.6.16.12

Linux Kernel 2.6.16.13

2.6.16.13

Linux Kernel 2.6.16.14

2.6.16.14

Linux Kernel 2.6.16.15

2.6.16.15

Linux Kernel 2.6.16.16

2.6.16.16

Linux Kernel 2.6.16.17

2.6.16.17

Linux Kernel 2.6.16.18

2.6.16.18

Linux Kernel 2.6.16.19

2.6.16.19

Linux Kernel 2.6.16.20

2.6.16.20

Linux Kernel 2.6.16.21

2.6.16.21

Linux Kernel 2.6.16.22

2.6.16.22

Linux Kernel 2.6.16.23

2.6.16.23

Linux Kernel 2.6.16.24

2.6.16.24

Linux Kernel 2.6.16.25

2.6.16.25

Linux Kernel 2.6.16.26

2.6.16.26

Linux Kernel 2.6.16.27

2.6.16.27

Linux Kernel 2.6.16.28

2.6.16.28

Linux Kernel 2.6.16.29

2.6.16.29

Linux Kernel 2.6.16.30

2.6.16.30

Linux Kernel 2.6.16.31

2.6.16.31

Linux Kernel 2.6.17

2.6.17

Linux Kernel 2.6.17.1

2.6.17.1

Linux Kernel 2.6.17.2

2.6.17.2

Linux Kernel 2.6.17.3

2.6.17.3

Linux Kernel 2.6.17.4

2.6.17.4

Linux Kernel 2.6.17.5

2.6.17.5

Linux Kernel 2.6.17.6

2.6.17.6

Linux Kernel 2.6.17.7

2.6.17.7

Linux Kernel 2.6.17.8

2.6.17.8

Linux Kernel 2.6.17.9

2.6.17.9

Linux Kernel 2.6.17.10

2.6.17.10

Linux Kernel 2.6.17.11

2.6.17.11

Linux Kernel 2.6.17.12

2.6.17.12

Linux Kernel 2.6.17.13

2.6.17.13

Linux Kernel 2.6.17.14

2.6.17.14

Linux Kernel 2.6.18.1

2.6.18.1

Linux Kernel 2.6.18.2

2.6.18.2

Linux Kernel 2.6.18.3

2.6.18.3

Linux Kernel 2.6.18.4

2.6.18.4

Linux Kernel 2.6.18.5

2.6.18.5

Linux Kernel 2.6.18.6

2.6.18.6

Linux Kernel 2.6.18.7

2.6.18.7

Linux Kernel 2.6.18.8

2.6.18.8

Linux Kernel 2.6.22

2.6.22

Linux Kernel 2.6.22.2

2.6.22.2

Linux Kernel 2.6.22.3

2.6.22.3

Linux Kernel 2.6.22.4

2.6.22.4

Linux Kernel 2.6.22.5

2.6.22.5

Linux Kernel 2.6.22.6

2.6.22.6

Linux Kernel 2.6.22.7

2.6.22.7

Linux Kernel 2.6.23

2.6.23

Linux Kernel 2.6.23 Release Candidate 1

2.6.23

Linux Kernel 2.6.23 release candidate 2

2.6.23

Linux Kernel 2.6.23.1

2.6.23.1

Linux Kernel 2.6.23.2

2.6.23.2

Linux Kernel 2.6.23.3

2.6.23.3

Linux Kernel 2.6.23.4

2.6.23.4

Linux Kernel 2.6.23.5

2.6.23.5

Linux Kernel 2.6.23.6

2.6.23.6

Linux Kernel 2.6.23.7

2.6.23.7

Linux Kernel 2.6.24 Release Candidate 1

2.6.24

Linux Kernel 2.6.24 Release Candidate 2

2.6.24

Linux Kernel 2.6.24 Release Candidate 3

2.6.24

Linux Kernel 2.6.24 Release Candidate 4

2.6.24

Linux Kernel 2.6.24 Release Candidate 5

2.6.24

Linux Kernel 2.6.32

2.6.32

Linux Kernel 2.6.32.1

2.6.32.1

Linux Kernel 2.6.32.2

2.6.32.2

Linux Kernel 2.6.32.3

2.6.32.3

Linux Kernel 2.6.32.4

2.6.32.4

Linux Kernel 2.6.33 Release Candidate 1

2.6.33

Linux Kernel 2.6.33 Release Candidate 2

2.6.33

Linux Kernel 2.6.33 Release Candidate 3

2.6.33

References

20100114 Locked fasync file descriptors can be referenced after free in >= 2.6.28

Exploit

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=53281b6d34d44308372d16acb7fb5327609f68b6

Patch, Vendor Advisory

SUSE-SA:2010:010

http://lock.cmpxchg8b.com/5ebe2294ecd0e0f08eab7690d2a6ee69/create_elf_tables.c

Exploit

38199

Vendor Advisory

39033

http://support.avaya.com/css/P8/documents/100073666

http://twitter.com/taviso/statuses/7744108017

Patch

http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.33-rc4-git1.bz2

Patch

RHSA-2010:0161

37806

https://bugzilla.redhat.com/show_bug.cgi?id=547906

oval:org.mitre.oval:def:7054

oval:org.mitre.oval:def:9201

RHSA-2010:0046

RHSA-2010:0095

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.