The audit_syscall_entry function in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass certain syscall audit configurations via crafted syscalls, a related issue to CVE-2009-0342 and CVE-2009-0343.
http://lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html
http://marc.info/?l=linux-kernel&m=123579056530191&w=2
http://marc.info/?l=linux-kernel&m=123579065130246&w=2
http://marc.info/?l=oss-security&m=123597642832637&w=2
http://rhn.redhat.com/errata/RHSA-2009-0459.html
http://rhn.redhat.com/errata/RHSA-2009-0473.html
http://scary.beasts.org/security/CESA-2009-001.html
http://secunia.com/advisories/34084
http://secunia.com/advisories/34917
http://secunia.com/advisories/34962
http://secunia.com/advisories/34981
http://secunia.com/advisories/35011
http://secunia.com/advisories/35015
http://secunia.com/advisories/35120
http://secunia.com/advisories/35121
http://secunia.com/advisories/35185
http://secunia.com/advisories/35390
http://secunia.com/advisories/35394
http://secunia.com/advisories/37471
http://wiki.rpath.com/Advisories:rPSA-2009-0084
http://www.debian.org/security/2009/dsa-1787
http://www.debian.org/security/2009/dsa-1794
http://www.debian.org/security/2009/dsa-1800
http://www.mandriva.com/security/advisories?name=MDVSA-2009:118
http://www.redhat.com/support/errata/RHSA-2009-0451.html
http://www.securityfocus.com/archive/1/503610/100/0/threaded
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/33951
http://www.securitytracker.com/id?1022153
http://www.ubuntu.com/usn/usn-751-1
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/3316
https://bugzilla.redhat.com/show_bug.cgi?id=487990
https://exchange.xforce.ibmcloud.com/vulnerabilities/49061
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8508
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9600
Source: MITRE
Published: 2009-03-06
Updated: 2020-08-26
Type: NVD-CWE-noinfo
Base Score: 3.6
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:N
Impact Score: 4.9
Exploitability Score: 3.9
Severity: LOW
OR
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to 2.6.28.7 (inclusive)
OR
OR
cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
OR
cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:4.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:5.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
OR
cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp2:*:*:*:*:*:*
ID | Name | Product | Family | Severity |
---|---|---|---|---|
89117 | VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check) | Nessus | Misc. | critical |
79456 | OracleVM 2.1 : kernel (OVMSA-2009-0009) | Nessus | OracleVM Local Security Checks | high |
67854 | Oracle Linux 5 : kernel (ELSA-2009-0473) | Nessus | Oracle Linux Local Security Checks | medium |
67853 | Oracle Linux 4 : kernel (ELSA-2009-0459) | Nessus | Oracle Linux Local Security Checks | medium |
63915 | RHEL 5 : kernel (RHSA-2010:0079) | Nessus | Red Hat Local Security Checks | critical |
60581 | Scientific Linux Security Update : kernel on SL5.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | medium |
60577 | Scientific Linux Security Update : kernel on SL4.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | medium |
59137 | SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 6236) | Nessus | SuSE Local Security Checks | high |
43746 | CentOS 5 : kernel (CESA-2009:0473) | Nessus | CentOS Local Security Checks | medium |
42870 | VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components. | Nessus | VMware ESX Local Security Checks | critical |
41539 | SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 6237) | Nessus | SuSE Local Security Checks | high |
40012 | openSUSE Security Update : kernel (kernel-951) | Nessus | SuSE Local Security Checks | critical |
39335 | openSUSE 10 Security Update : kernel (kernel-6274) | Nessus | SuSE Local Security Checks | critical |
38902 | CentOS 4 : kernel (CESA-2009:0459) | Nessus | CentOS Local Security Checks | medium |
38845 | Mandriva Linux Security Advisory : kernel (MDVSA-2009:118) | Nessus | Mandriva Local Security Checks | medium |
38795 | Debian DSA-1800-1 : linux-2.6 - denial of service/privilege escalation/sensitive memory leak | Nessus | Debian Local Security Checks | high |
38722 | Debian DSA-1794-1 : linux-2.6 - denial of service/privilege escalation/information leak | Nessus | Debian Local Security Checks | critical |
38709 | RHEL 5 : kernel (RHSA-2009:0473) | Nessus | Red Hat Local Security Checks | medium |
38668 | Debian DSA-1787-1 : linux-2.6.24 - denial of service/privilege escalation/information leak | Nessus | Debian Local Security Checks | critical |
38661 | RHEL 4 : kernel (RHSA-2009:0459) | Nessus | Red Hat Local Security Checks | medium |
37337 | Ubuntu 7.10 / 8.04 LTS / 8.10 : linux, linux-source-2.6.22 vulnerabilities (USN-751-1) | Nessus | Ubuntu Local Security Checks | critical |
36418 | Ubuntu 6.06 LTS : linux-source-2.6.15 vulnerabilities (USN-752-1) | Nessus | Ubuntu Local Security Checks | critical |
801469 | CentOS RHSA-2009-0473 Security Check | Log Correlation Engine | Generic | high |