CVE-2009-4131 Missing authorization in n/a
Local attackers can overwrite arbitrary files in the Linux kernel ext4 filesystem due to insufficient permission checks in the move extents ioctl.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-4131?
CVE-2009-4131 is a high-severity missing authorization vulnerability in Linux kernel, published on 13 Dec 2009. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel before 2.6.32-git6 allows local users to overwrite arbitrary files via a crafted request, related to insufficient checks for file permissions.
Weakness: CWE-264
Which versions are affected by CVE-2009-4131?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2009-4131?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2009-4131 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-4131 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Linux kernel
Sources
Also known as GHSA-w5q9-4w6f-xc45.