CVE-2009-3547：Linux内核管道文件系统中的竞争条件漏洞详解

本文详细分析了CVE-2009-3547漏洞，该漏洞存在于Linux内核2.6.32-rc6之前的fs/pipe.c文件中，本地用户可通过竞态条件引发空指针解引用，导致系统崩溃或权限提升。

CVE-2009-3547 漏洞详情

状态：推迟 此CVE记录因资源或其他问题，暂未被NVD列为优先丰富内容的目标。

描述 Linux内核2.6.32-rc6之前版本中fs/pipe.c文件存在多个竞态条件。本地用户通过尝试以/proc/*/fd/路径名打开匿名管道，可导致拒绝服务（空指针解引用和系统崩溃）或提升权限。

漏洞评分

CVSS 4.0 严重性及向量字符串：

  • NIST: NVD
    • NVD 评估尚未提供。

CVSS 3.x 严重性及向量字符串：

  • NIST: NVD
    • 基础评分：7.0 HIGH
    • 向量： CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 严重性及向量字符串：

  • NIST: NVD
    • 基础评分：6.9 MEDIUM
    • 向量： (AV:L/AC:M/Au:N/C:C/I:C/A:C)

相关参考（公告、解决方案和工具）

注意： 点击以下链接将离开NIST网站。我们提供这些链接是因为它们可能包含您感兴趣的信息。不应因为引用或未引用其他网站而做出任何推断。可能有其他网站更适合您的目的。NIST不一定认可这些站点表达的观点，也不认同其陈述的事实。此外，NIST不认可这些站点可能提及的任何商业产品。有关此页面的意见，请发送至 nvd@nist.gov。

链接 来源 标签
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3960243e55320d74195fb85c975e0a8cc4466c CVE, Inc., Red Hat CVE, Broken Link
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html CVE, Inc., Red Hat Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html CVE, Inc., Red Hat Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html CVE, Inc., Red Hat Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html CVE, Inc., Red Hat Broken Link, Mailing List, Third Party Advisory
http://lists.vmware.com/pipermail/security-announce/2010/000082.html CVE, Inc., Red Hat Mailing List, Third Party Advisory
http://lkml.org/lkml/2009/10/14/184 CVE, Inc., Red Hat Exploit, Mailing List
http://lkml.org/lkml/2009/10/21/42 CVE, Inc., Red Hat Mailing List, Patch
http://marc.info/?l=oss-security&m=125724568017045&w=2 CVE, Inc., Red Hat Mailing List, Third Party Advisory
http://secunia.com/advisories/37351 CVE, Inc., Red Hat Broken Link
http://secunia.com/advisories/38017 CVE, Inc., Red Hat Broken Link
http://secunia.com/advisories/38794 CVE, Inc., Red Hat Broken Link
http://secunia.com/advisories/38834 CVE, Inc., Red Hat Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc6 CVE, Inc., Red Hat Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2009:329 CVE, Inc., Red Hat Broken Link
http://www.redhat.com/support/errata/RHSA-2009-1672.html CVE, Inc., Red Hat Broken Link
http://www.securityfocus.com/archive/1/512019/100/0/threaded CVE, Inc., Red Hat Broken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/36901 CVE, Inc., Red Hat Broken Link, Exploit, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/usn-864-1 CVE, Inc., Red Hat Third Party Advisory
http://www.vupen.com/english/advisories/2010/0528 CVE, Inc., Red Hat Broken Link

| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11513 | CVE, Inc., Red Hat | Broken Link, Third Party Advisory | | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7608 | CVE, Inc., Red Hat | Broken Link, Third Party Advisory | | https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9327 | CVE, Inc., Red Hat | Broken Link, Third Party Advisory | | https://rhn.redhat.com/errata/RHSA-2009-1540.html | CVE, Inc., Red Hat | Third Party Advisory | | https://rhn.redhat.com/errata/RHSA-2009-1541.html | CVE, Inc., Red Hat | Third Party Advisory | | https://rhn.redhat.com/errata/RHSA-2009-1548.html | CVE, Inc., Red Hat | Third Party Advisory | | https://rhn.redhat.com/errata/RHSA-2009-1550.html | CVE, Inc., Red Hat | Third Party Advisory | | https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.html | CVE, Inc., Red Hat | Mailing List |

弱点枚举

CWE-ID CWE 名称 来源
CWE-362 使用共享资源并发执行且同步不当（‘竞态条件’） NIST
CWE-476 空指针解引用 NIST
CWE-672 在资源过期或释放后对其操作 NIST

已知受影响软件配置

（切换至 CPE 2.2）

配置 1

  • cpe:2.3:o:linux:linux_kernel:::::::: 版本至（包括） 2.6.31.14
  • cpe:2.3:o:linux:linux_kernel:2.6.32:-::::::
  • cpe:2.3:o:linux:linux_kernel:2.6.32:rc1::::::
  • cpe:2.3:o:linux:linux_kernel:2.6.32:rc2::::::
  • cpe:2.3:o:linux:linux_kernel:2.6.32:rc3::::::
  • cpe:2.3:o:linux:linux_kernel:2.6.32:rc4::::::
  • cpe:2.3:o:linux:linux_kernel:2.6.32:rc5::::::

配置 2

  • cpe:2.3:o:novell:linux_desktop:9:::::::*
  • cpe:2.3:o:opensuse:opensuse:11.0:::::::*
  • cpe:2.3:o:opensuse:opensuse:11.2:::::::*
  • cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp2::::::
  • cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp2::::::

配置 3

  • cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*
  • cpe:2.3:o:canonical:ubuntu_linux:8.04:::::::*
  • cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::*
  • cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::*
  • cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::*

配置 4

  • cpe:2.3:o:fedoraproject:fedora:10:::::::*

配置 5

  • cpe:2.3:a:vmware:vma:4.0:::::::*
  • cpe:2.3:o:vmware:esx:4.0:::::::*

配置 6

  • cpe:2.3:a:redhat:mrg_realtime:1.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:3.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:4.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_eus:4.8:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_eus:5.4:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_server:3.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_server:4.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:3.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:4.0:::::::*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*

表示易受攻击的软件

变更历史

共找到 10 条变更记录 （此处省略了详细的变更历史表格，内容涉及CVE、NIST、Red Hat等机构在不同日期对描述、评分、参考链接、CPE配置、CWE分类等信息的添加、修改和删除操作。）

comments powered by Disqus
© 2020 - 2026 qife
使用 Hugo 构建
主题 Stack 由 Jimmy 设计
本站总访问量次 本站访客数人次