NetSight
IP …
medium4.9Public exploit code

CVE-2009-2847

The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear cer…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.

Affected products

VendorProductAffected versions
LinuxKernel
Versions 2.6.24.7, 2.6.25.15
LinuxLinux Kernel
through 2.6.16.31
Versions 2.6, 2.6.0, 2.6.1, 2.6.10, 2.6.11

References