CVE-2007-1189 Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument, as demonstra...
HighCVSS 7.2
EPSS 0.80%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument, as demonstrated by (1) modifying the iseve function to gain privileges and (2) making the devpermcheck function grant unrestricted device permissions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bell labs plan 9 | All versions | No fix listed |
References
- kernelspace.us exploit
- [dailydave] 20070227 Wow, free kernel zero day? exploit mailing-list
- 34956 vdb-entry
- 22749 exploit vdb-entry
- 3383 exploit