CVE-2009-0343

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-01-29 · updated 2026-06-16
Weakness: CWE-264

Description

Niels Provos Systrace 1.6f and earlier on the x86_64 Linux platform allows local users to bypass intended access restrictions by making a 32-bit syscall with a syscall number that corresponds to a policy-compliant 64-bit syscall, related to race conditions that occur in monitoring 64-bit processes.

Affected products

Niels Provos Systrace: through 1.6e; 1.1, 1.2, 1.3, 1.4, 1.5, 1.6 (+4)

References

http://scary.beasts.org/security/CESA-2009-001.html
http://scarybeastsecurity.blogspot.com/2009/01/bypassing-syscall-filtering.html
http://www.citi.umich.edu/u/provos/systrace/
http://www.securityfocus.com/archive/1/500377/100/0/threaded
http://www.securityfocus.com/bid/33417
http://scary.beasts.org/security/CESA-2009-001.html
http://scarybeastsecurity.blogspot.com/2009/01/bypassing-syscall-filtering.html
http://www.citi.umich.edu/u/provos/systrace/
http://www.securityfocus.com/archive/1/500377/100/0/threaded
http://www.securityfocus.com/bid/33417

Get alerted when CVE-2009-0343 or the next vulnerability affects your stack