CVE-2009-3002
Linux Kernel < 2.6.31 - Information Disclosure via Uninitialized Memory in getname Functions
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2009-3002. PoCs published by Jon Oberheide, Clément Lecigne.
AI-analyzed exploit summary This exploit demonstrates an information leak vulnerability in Linux Kernel < 2.6.31-rc7 by calling getsockname on an AF_IRDA socket, which discloses 29 bytes of kernel stack memory. The PoC continuously calls getsockname while performing random syscalls to make the stack content more interesting.
Description
The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket, related to the econet_getname function in net/econet/af_econet.c; (4) an AF_NETROM socket, related to the nr_getname function in net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket, related to the raw_getname function in net/can/raw.c.
Exploits (2)
This exploit demonstrates an information leak vulnerability in Linux Kernel < 2.6.31-rc7 by calling getsockname on an AF_IRDA socket, which discloses 29 bytes of kernel stack memory. The PoC continuously calls getsockname while performing random syscalls to make the stack content more interesting.
This exploit leverages a kernel stack disclosure vulnerability in Linux kernels <= 2.6.30 via AppleTalk's getsockname() function to leak 8 bytes of kernel memory. It uses randomized syscalls and socket operations to trigger the leak and dumps the disclosed memory contents.