Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2009-1895 Details

Description

The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html	CVE	PatchThird Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6	CVE
http://patchwork.kernel.org/patch/32598/	CVE	PatchVendor Advisory
https://bugs.launchpad.net/bugs/cve/2009-1895	CVE	Third Party Advisory
http://secunia.com/advisories/35801	CVE	Third Party Advisory
http://secunia.com/advisories/36045	CVE	Third Party Advisory
http://secunia.com/advisories/36051	CVE	Third Party Advisory
http://secunia.com/advisories/36054	CVE	Third Party Advisory
http://secunia.com/advisories/36116	CVE	Third Party Advisory
http://secunia.com/advisories/36131	CVE	Third Party Advisory
http://secunia.com/advisories/36759	CVE	Third Party Advisory
http://secunia.com/advisories/37471	CVE	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11768	CVE	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7826	CVE	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9453	CVE	Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1540.html	CVE	Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1550.html	CVE	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00166.html	CVE	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00223.html	CVE	Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0111	CVE	Third Party Advisory
http://www.debian.org/security/2009/dsa-1844	CVE	Third Party Advisory
http://www.debian.org/security/2009/dsa-1845	CVE	Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc3	CVE	Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:051	CVE	Third Party Advisory
http://www.osvdb.org/55807	CVE	Broken Link
http://www.redhat.com/support/errata/RHSA-2009-1193.html	CVE	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1438.html	CVE	Third Party Advisory
http://www.securityfocus.com/archive/1/505254/100/0/threaded	CVE	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/507985/100/0/threaded	CVE	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/512019/100/0/threaded	CVE	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/35647	CVE	Third Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/usn-807-1	CVE	Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2009-0016.html	CVE	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1866	CVE	PatchThird Party Advisory
http://www.vupen.com/english/advisories/2009/3316	CVE	Third Party Advisory
http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html	[email protected]	PatchThird Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6	[email protected]
http://patchwork.kernel.org/patch/32598/	[email protected]	PatchVendor Advisory
https://bugs.launchpad.net/bugs/cve/2009-1895	[email protected]	Third Party Advisory
http://secunia.com/advisories/35801	[email protected]	Third Party Advisory
http://secunia.com/advisories/36045	[email protected]	Third Party Advisory
http://secunia.com/advisories/36051	[email protected]	Third Party Advisory
http://secunia.com/advisories/36054	[email protected]	Third Party Advisory
http://secunia.com/advisories/36116	[email protected]	Third Party Advisory
http://secunia.com/advisories/36131	[email protected]	Third Party Advisory
http://secunia.com/advisories/36759	[email protected]	Third Party Advisory
http://secunia.com/advisories/37471	[email protected]	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11768	[email protected]	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7826	[email protected]	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9453	[email protected]	Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1540.html	[email protected]	Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2009-1550.html	[email protected]	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00166.html	[email protected]	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00223.html	[email protected]	Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0111	[email protected]	Third Party Advisory
http://www.debian.org/security/2009/dsa-1844	[email protected]	Third Party Advisory
http://www.debian.org/security/2009/dsa-1845	[email protected]	Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc3	[email protected]	Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:051	[email protected]	Third Party Advisory
http://www.osvdb.org/55807	[email protected]	Broken Link
http://www.redhat.com/support/errata/RHSA-2009-1193.html	[email protected]	Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1438.html	[email protected]	Third Party Advisory
http://www.securityfocus.com/archive/1/505254/100/0/threaded	[email protected]	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/507985/100/0/threaded	[email protected]	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/archive/1/512019/100/0/threaded	[email protected]	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/35647	[email protected]	Third Party AdvisoryVDB Entry
http://www.ubuntu.com/usn/usn-807-1	[email protected]	Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2009-0016.html	[email protected]	Third Party Advisory
http://www.vupen.com/english/advisories/2009/1866	[email protected]	PatchThird Party Advisory
http://www.vupen.com/english/advisories/2009/3316	[email protected]	Third Party Advisory

see all 70 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-16	Configuration	[email protected]

Affected Products

Product	Versions
linux linux kernel	<= 2.6.31 2.6.31 rc1 2.6.31 rc2
CPE cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:2.6.31:rc1:::::: cpe:2.3:o:linux:linux_kernel:2.6.31:rc2:::::: Remediation No remediation found in references.
debian debian linux	4.0 5.0
CPE cpe:2.3:o:debian:debian_linux:4.0:::::::* cpe:2.3:o:debian:debian_linux:5.0:::::::* Remediation No remediation found in references.
canonical ubuntu linux	6.06 8.04 8.10 9.04
CPE cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts::: cpe:2.3:o:canonical:ubuntu_linux:8.04::::lts::: cpe:2.3:o:canonical:ubuntu_linux:8.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:9.04:::::::* Remediation No remediation found in references.

Change History

9 change records found show changes

Date	Action	Recorded By
Jun 16, 2026	CVE Modified	[email protected]
Apr 23, 2026	Status Change	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 13, 2023	CVE Modified	[email protected]
Nov 8, 2018	Modified Analysis	[email protected]
Oct 10, 2018	CVE Modified	[email protected]
Sep 29, 2017	CVE Modified	[email protected]
Jul 16, 2009	Initial Analysis	[email protected]

CVE-2009-1895 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO