CVE-2009-0036

libvirt_proxy 0.5.1 - Buffer Overflow

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2009-0036. PoCs published by Jon Oberheide.

AI-analyzed exploit summary This exploit targets a buffer overflow in libvirt_proxy <= 0.5.1 (CVE-2009-0036) by sending a malformed packet header followed by a NOP sled and shellcode to achieve local privilege escalation. It leverages uninitialized memory in the validation check to overwrite EIP and execute arbitrary code as root.

Description

Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Jon Oberheide · clocallinux
https://www.exploit-db.com/exploits/8534

This exploit targets a buffer overflow in libvirt_proxy <= 0.5.1 (CVE-2009-0036) by sending a malformed packet header followed by a NOP sled and shellcode to achieve local privilege escalation. It leverages uninitialized memory in the validation check to overwrite EIP and execute arbitrary code as root.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Racy
Target: libvirt_proxy <= 0.5.1
No auth needed
Prerequisites: Local access to the target system · libvirt_proxy setuid binary present · Ability to connect to the Unix socket at /tmp/livirt_proxy_conn
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (10)

Core 10
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10127
Exploit, Vendor Advisory mailing-list x_refsource_mlist
https://www.redhat.com/archives/libvir-list/2009-January/msg00728.html
Exploit, Vendor Advisory mailing-list x_refsource_mlist
https://www.redhat.com/archives/libvir-list/2009-January/msg00726.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/33724
Exploit, Vendor Advisory mailing-list x_refsource_mlist
https://www.redhat.com/archives/libvir-list/2009-January/msg00699.html
Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=484947
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2009-0382.html
Mailing List mailing-list x_refsource_mlist
http://openwall.com/lists/oss-security/2009/02/10/8
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/34397

Scores

EPSS 0.0117
EPSS Percentile 63.3%

Details

CWE
CWE-119
Status published
Products (1)
libvirt/libvirt 0.5.1
Published Feb 11, 2009
Tracked Since Feb 18, 2026