2.6.27.11 : Security Vulnerabilities Published In 2009

Cpe Name:cpe:/o:linux:linux_kernel:2.6.27.11

2009 : January February March April May June July August September October November December

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2009-4308	399		DoS	2009-12-12	2012-03-19	7.1	None	Remote	Medium	Not required	None	None	Complete
The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.
2	CVE-2009-4307	189		DoS	2009-12-12	2012-03-19	7.1	None	Remote	Medium	Not required	None	None	Complete
The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).
3	CVE-2009-4306			DoS	2009-12-12	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability than CVE-2009-4131.
4	CVE-2009-4138	399		DoS	2009-12-16	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains zero in the payload-length field.
5	CVE-2009-4131	264			2009-12-12	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel before 2.6.32-git6 allows local users to overwrite arbitrary files via a crafted request, related to insufficient checks for file permissions.
6	CVE-2009-4031	20		DoS	2009-11-29	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid, which allows guest OS users to cause a denial of service (increased scheduling latency) on the host OS via unspecified manipulations related to SMP support.
7	CVE-2009-4027	362		DoS	2009-12-02	2012-03-19	7.1	None	Remote	Medium	Not required	None	None	Complete
Race condition in the mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (system crash) via a Delete Block ACK (aka DELBA) packet that triggers a certain state change in the absence of an aggregation session.
8	CVE-2009-4026			DoS	2009-12-02	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
The mac80211 subsystem in the Linux kernel before 2.6.32-rc8-next-20091201 allows remote attackers to cause a denial of service (panic) via a crafted Delete Block ACK (aka DELBA) packet, related to an erroneous "code shuffling patch."
9	CVE-2009-4021	399		DoS	2009-11-25	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow attackers to cause a denial of service (invalid pointer dereference and OOPS) via vectors possibly related to a memory-consumption attack.
10	CVE-2009-4005	119		Overflow	2009-11-19	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.
11	CVE-2009-4004	119		DoS Overflow +Priv Mem. Corr.	2009-11-19	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Buffer overflow in the kvm_vcpu_ioctl_x86_setup_mce function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc7 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a KVM_X86_SETUP_MCE IOCTL request that specifies a large number of Machine Check Exception (MCE) banks.
12	CVE-2009-3939	264			2009-11-16	2012-03-19	6.6	None	Local	Low	Not required	None	Complete	Complete
The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.
13	CVE-2009-3888	399		DoS	2009-11-16	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The do_mmap_pgoff function in mm/nommu.c in the Linux kernel before 2.6.31.6, when the CPU lacks a memory management unit, allows local users to cause a denial of service (OOPS) via an application that attempts to allocate a large amount of memory.
14	CVE-2009-3726	399		DoS	2009-11-09	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel before 2.6.31-rc4 allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) by sending a certain response containing incorrect file attributes, which trigger attempted use of an open file that lacks NFSv4 state.
15	CVE-2009-3725	264		+Priv Bypass	2009-11-06	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.
16	CVE-2009-3722	264		DoS	2009-10-30	2012-03-19	7.1	None	Remote	Medium	Not required	None	None	Complete
The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 2.6.31.1 does not properly verify the Current Privilege Level (CPL) before accessing a debug register, which allows guest OS users to cause a denial of service (trap) on the host OS via a crafted application.
17	CVE-2009-3640	20		DoS +Priv	2009-10-29	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The update_cr8_intercept function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc1 does not properly handle the absence of an Advanced Programmable Interrupt Controller (APIC), which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via a call to the kvm_vcpu_ioctl function.
18	CVE-2009-3638	189		Overflow	2009-10-29	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.31.4 allows local users to have an unspecified impact via a KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.
19	CVE-2009-3624	310		DoS +Priv	2009-11-02	2012-03-19	4.6	None	Local	Low	Not required	Partial	Partial	Partial
The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.
20	CVE-2009-3623	287		DoS	2009-10-30	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an NFSv4 mount request.
21	CVE-2009-3621			DoS	2009-10-22	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.
22	CVE-2009-3620	20		DoS +Priv	2009-10-22	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
23	CVE-2009-3613	399		DoS	2009-10-19	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping.
24	CVE-2009-3612	200		+Info	2009-10-19	2012-03-19	4.9	None	Local	Low	Not required	Complete	None	None
The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.
25	CVE-2009-3547	362		DoS +Priv	2009-11-04	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
26	CVE-2009-3280	119		DoS Overflow	2009-09-21	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
Integer signedness error in the find_ie function in net/wireless/scan.c in the cfg80211 subsystem in the Linux kernel before 2.6.31.1-rc1 allows remote attackers to cause a denial of service (soft lockup) via malformed packets.
27	CVE-2009-3238	310			2009-09-18	2012-03-19	7.8	None	Remote	Low	Not required	Complete	None	None
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
28	CVE-2009-3228	200		+Info	2009-10-19	2012-03-19	4.9	None	Local	Low	Not required	Complete	None	None
The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.
29	CVE-2009-3080			DoS +Priv	2009-11-20	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Array index error in the gdth_read_event function in drivers/scsi/gdth.c in the Linux kernel before 2.6.32-rc8 allows local users to cause a denial of service or possibly gain privileges via a negative event index in an IOCTL request.
30	CVE-2009-3043	399		DoS +Priv	2009-09-02	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux kernel 2.6.31-rc before 2.6.31-rc8 allows local users to cause a denial of service (system crash, sometimes preceded by a NULL pointer dereference) or possibly gain privileges via certain pseudo-terminal I/O activity, as demonstrated by KernelTtyTest.c.
31	CVE-2009-3002	200	1	+Info	2009-08-28	2012-03-19	4.9	None	Local	Low	Not required	Complete	None	None
The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket, related to the econet_getname function in net/econet/af_econet.c; (4) an AF_NETROM socket, related to the nr_getname function in net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket, related to the raw_getname function in net/can/raw.c.
32	CVE-2009-3001	200	1	+Info	2009-08-28	2012-03-19	4.9	None	Local	Low	Not required	Complete	None	None
The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel 2.6.31-rc7 and earlier does not initialize a certain data structure, which allows local users to read the contents of some kernel memory locations by calling getsockname on an AF_LLC socket.
33	CVE-2009-2910	200		+Info	2009-10-20	2012-03-19	4.9	None	Local	Low	Not required	Complete	None	None
arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.
34	CVE-2009-2909	189		DoS	2009-10-20	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
Integer signedness error in the ax25_setsockopt function in net/ax25/af_ax25.c in the ax25 subsystem in the Linux kernel before 2.6.31.2 allows local users to cause a denial of service (OOPS) via a crafted optlen value in an SO_BINDTODEVICE operation.
35	CVE-2009-2903	399		DoS	2009-09-15	2012-04-12	7.1	None	Remote	Medium	Not required	None	None	Complete
Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
36	CVE-2009-2849			DoS	2009-08-18	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 might allow local users to cause a denial of service (NULL pointer dereference) via vectors related to "suspend_* sysfs attributes" and the (1) suspend_lo_store or (2) suspend_hi_store functions. NOTE: this is only a vulnerability when sysfs is writable by an attacker.
37	CVE-2009-2848			DoS +Priv Mem. Corr.	2009-08-18	2013-01-22	4.7	None	Local	Medium	Not required	None	None	Complete
The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clear_child_tid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONE_CHILD_SETTID or CLONE_CHILD_CLEARTID enabled, which is not properly handled during thread creation and exit.
38	CVE-2009-2846	264		Bypass	2009-08-18	2012-03-19	7.8	None	Remote	Low	Not required	Complete	None	None
The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.
39	CVE-2009-2768	119		DoS Overflow	2009-08-14	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The load_flat_shared_library function in fs/binfmt_flat.c in the flat subsystem in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by executing a shared flat binary, which triggers an access of an "uninitialized cred pointer."
40	CVE-2009-2695	119		Overflow +Priv	2009-08-28	2012-03-19	7.2	Admin	Local	Low	Not required	Complete	Complete	Complete
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
41	CVE-2009-2584	189		Overflow +Priv	2009-07-23	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow.
42	CVE-2009-2407	119		DoS Overflow +Priv	2009-07-31	2012-03-19	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet.
43	CVE-2009-2287	20		DoS	2009-07-01	2012-03-19	4.9	None	Local	Low	Not required	None	None	Complete
The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
44	CVE-2009-1961	362		DoS	2009-06-07	2012-03-19	1.9	None	Local	Medium	Not required	None	None	Partial
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.
45	CVE-2009-1914	20		DoS	2009-06-04	2012-04-12	4.9	None	Local	Low	Not required	None	None	Complete
The pci_register_iommu_region function in arch/sparc/kernel/pci_common.c in the Linux kernel before 2.6.29 on the sparc64 platform allows local users to cause a denial of service (system crash) by reading the /proc/iomem file, related to uninitialized pointers and the request_resource function.
46	CVE-2009-1895	16		Bypass	2009-07-16	2012-03-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).
47	CVE-2009-1633	119		DoS Overflow Mem. Corr.	2009-05-28	2012-03-23	7.1	None	Remote	Medium	Not required	None	None	Complete
Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.
48	CVE-2009-1630	264		Bypass	2009-05-14	2012-04-12	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
The nfs_permission function in fs/nfs/dir.c in the NFS client implementation in the Linux kernel 2.6.29.3 and earlier, when atomic_open is available, does not check execute (aka EXEC or MAY_EXEC) permission bits, which allows local users to bypass permissions and execute files, as demonstrated by files on an NFSv4 fileserver.
49	CVE-2009-1527	362		+Priv	2009-05-05	2012-03-19	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Race condition in the ptrace_attach function in kernel/ptrace.c in the Linux kernel before 2.6.30-rc4 allows local users to gain privileges via a PTRACE_ATTACH ptrace call during an exec system call that is launching a setuid application, related to locking an incorrect cred_exec_mutex object.
50	CVE-2009-1439	119		DoS Overflow	2009-04-27	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel 2.6.29 and earlier allows remote attackers to cause a denial of service (crash) via a long nativeFileSystem field in a Tree Connect response to an SMB mount request.

Total number of vulnerabilities : 70 Page : 1 (This Page)2