CVE-2009-2406

kernel: ecryptfs stack overflow in parse_tag_11_packet()

Published Jul 31, 2009 CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-1844-1 New Linux 2.6.24 packages fix several vulnerabilities
Debian DSA Debian DSA DSA-1845-1 New Linux 2.6.26 packages fix several vulnerabilities
EUVD EUVD EUVD-2009-2402 Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.
Ubuntu USN Ubuntu USN USN-807-1 Linux kernel vulnerabilities
References
Link Providers
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6352a29305373ae6196491e6d4669f301e26492e cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html cve-icon cve-icon
http://risesecurity.org/advisories/RISE-2009002.txt cve-icon cve-icon
http://secunia.com/advisories/35985 cve-icon cve-icon
http://secunia.com/advisories/36045 cve-icon cve-icon
http://secunia.com/advisories/36051 cve-icon cve-icon
http://secunia.com/advisories/36054 cve-icon cve-icon
http://secunia.com/advisories/36116 cve-icon cve-icon
http://secunia.com/advisories/36131 cve-icon cve-icon
http://secunia.com/advisories/37471 cve-icon cve-icon
http://www.debian.org/security/2009/dsa-1844 cve-icon cve-icon
http://www.debian.org/security/2009/dsa-1845 cve-icon cve-icon
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.4 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2011:029 cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2009-1193.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/505334/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/507985/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/35851 cve-icon cve-icon
http://www.securitytracker.com/id?1022663 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-807-1 cve-icon cve-icon
http://www.vmware.com/security/advisories/VMSA-2009-0016.html cve-icon cve-icon
http://www.vupen.com/english/advisories/2009/2041 cve-icon cve-icon
http://www.vupen.com/english/advisories/2009/3316 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2009-2406 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10072 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8246 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2009-2406 cve-icon
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00166.html cve-icon cve-icon
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00223.html cve-icon cve-icon
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 7, 2024, 5:52 AM
Reserved
Jul 9, 2009, 12:00 AM
Status
Modified
Published
Jul 31, 2009, 7:00 PM
Modified
Jun 16, 2026, 11:09 PM
Severity
Important
Public date
Jul 28, 2009, 12:00 AM