CVE:CVE-2009-1185
CNNVD:CNNVD-200904-353
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。
Linux kernel存在访问控制错误漏洞，该漏洞源于没有正确地检查消息的来源，本地攻击者可以利用这个漏洞从用户空间进程而不是内核向udev发送特制的Netlink消息，导致其创建已有系统块设备完全可写的块设备文件，以获得root用户权限。
solution:Upgrade udev_project udev to a higher version than 141,and avoid the version (,141); Upgrade suse linux_enterprise_debuginfo to a higher version than 10:sp2,11,and avoid the version 10:sp2,11; Upgrade opensuse opensuse to a higher version than 10.3,11.0,11.1,and avoid the version 10.3,11.0,11.1; Upgrade suse linux_enterprise_desktop to a higher version than 10:sp2,11,and avoid the version 10:sp2,11; Upgrade suse linux_enterprise_server to a higher version than 10:sp2,11,and avoid the version 10:sp2,11; Upgrade debian debian_linux to a higher version than 4.0,5.0,and avoid the version 4.0,5.0; Upgrade canonical ubuntu_linux to a higher version than 6.06,7.10,8.04,8.10,and avoid the version 6.06,7.10,8.04,8.10; Upgrade fedoraproject fedora to a higher version than 9,10,and avoid the version 9,10; Upgrade juniper ctpview to a higher version than 7.1,7.1,7.1:r1,7.2,and avoid the version (,7.1),7.1,7.1:r1,7.2