Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

Linux kernel lets local user change a program's exit signal

CVE-2009-1337 · published 17 years ago
Summary

In Linux kernel versions earlier than 2.6.30-rc1, a user who has the ability to kill processes can alter the signal a program sends when it ends. This can be abused to influence privileged (setuid) applications and potentially gain unauthorized access. Upgrade to a kernel version that includes the fix or apply your distribution's security update as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
linux linux_kernel <= 2.6.29
2.2.27
2.4.36
2.4.36.1
2.4.36.2
2.4.36.3
2.4.36.4
2.4.36.5
2.4.36.6
2.6
2.6.0
2.6.1
282 more version ranges
cpe:2.3:o:linux:linux_kernel:*:rc2_git7:*:*:*:*:*:*
Original advisory text
The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary si...
The exit_notify function in kernel/exit.c in the Linux kernel before 2.6.30-rc1 does not restrict exit signals when the CAP_KILL capability is held, which allows local users to send an arbitrary signal to a process by running a program that modifies the exit_signal field and then uses an exec system call to launch a setuid application.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.4 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published22 Apr 2009
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2009-1337 · NVD
Track software like this
Free during beta