Bug 495051 (CVE-2009-1185)

Summary:	CVE-2009-1185 udev: Uncheck origin of NETLINK messages
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	harald, kreilly, mjc, msusta, rcvalle, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-04-17 15:58:36 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	495055, 495056
Bug Blocks:

Description Jan Lieskovsky 2009-04-09 13:00:37 UTC

A privilege escalation flaw was found in the way udev used to check for
the origin of messages sent from the NETLINK service. An attacker could
use this flaw to escalate his privileges by sending the NETLINK message
from userspace process, instead of from the kernel.

Acknowledgements:

Red Hat would like to thank Sebastian Krahmer of the SUSE Security Team for
responsibly reporting this flaw.

Comment 1 Jan Lieskovsky 2009-04-09 13:10:50 UTC

Upstream commits:
http://git.kernel.org/?p=linux/hotplug/udev.git;a=commitdiff;h=e2b362d9f23d4c63018709ab5f81a02f72b91e75
http://git.kernel.org/?p=linux/hotplug/udev.git;a=commitdiff;h=e86a923d508c2aed371cdd958ce82489cf2ab615

Comment 11 Fedora Update System 2009-04-15 17:16:47 UTC

udev-124-3.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/udev-124-3.fc9

Comment 12 Fedora Update System 2009-04-15 17:24:00 UTC

udev-127-4.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/udev-127-4.fc10

Comment 13 Fedora Update System 2009-04-16 06:52:13 UTC

udev-124-4.fc9 has been submitted as an update for Fedora 9.
http://admin.fedoraproject.org/updates/udev-124-4.fc9

Comment 14 Fedora Update System 2009-04-16 16:54:17 UTC

udev-124-4.fc9 has been pushed to the Fedora 9 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2009-04-16 16:54:27 UTC

udev-127-5.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 errata-xmlrpc 2009-04-16 19:35:42 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0427 https://rhn.redhat.com/errata/RHSA-2009-0427.html

Comment 17 Tomas Hoger 2009-04-17 15:58:36 UTC

This issue did not affect the versions of udev as shipped with Red Hat Enterprise Linux 4.  Issue was fixed upstream in version 141.