CVE-2009-3624: linux kernel Cryptographic Issues

Vulnerability summary

CVE-2009-3624 is a medium (CVSS 4.6) Cryptographic Issues vulnerability in linux kernel. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.6% of scored vulnerabilities.

Timeline

1. 02-11-2009
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.

• CWE-310Cryptographic IssuesWeaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.