CVE-2007-1189

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-03-02 · updated 2026-06-16

Description

Integer overflow in the envwrite function in the Alcatel-Lucent Bell Labs Plan 9 kernel allows local users to overwrite certain memory addresses with kernel memory via a large n argument, as demonstrated by (1) modifying the iseve function to gain privileges and (2) making the devpermcheck function grant unrestricted device permissions.

Affected products

Bell Labs Plan 9: all versions

References

http://kernelspace.us/itheft.c
http://lists.immunitysec.com/pipermail/dailydave/2007-February/004118.html
http://osvdb.org/34956
http://www.securityfocus.com/bid/22749
https://www.exploit-db.com/exploits/3383
http://kernelspace.us/itheft.c
http://lists.immunitysec.com/pipermail/dailydave/2007-February/004118.html
http://osvdb.org/34956
http://www.securityfocus.com/bid/22749
https://www.exploit-db.com/exploits/3383

Get alerted when CVE-2007-1189 or the next vulnerability affects your stack