CVE-2009-0835
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel...
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
Exploit likelihood
What each source reports
NVD Score used
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
- Record
CVE-2009-0835- CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
- Record
CVE-2009-0835- Updated
- 2026-11-02
EUVDEUVD-2009-0832 No score
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
- Record
EUVD-2009-0832- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x75x-89gj-wfcm No score
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel...
The __secure_computing function in kernel/seccomp.c in the seccomp subsystem in the Linux kernel 2.6.28.7 and earlier on the x86_64 platform, when CONFIG_SECCOMP is enabled, does not properly handle (1) a 32-bit process making a 64-bit syscall or (2) a 64-bit process making a 32-bit syscall, which allows local users to bypass intended access restrictions via crafted syscalls that are misinterpreted as (a) stat or (b) chmod, a related issue to CVE-2009-0342 and CVE-2009-0343.
- Record
GHSA-x75x-89gj-wfcm- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linux-2.6Debian:5.0 From an advisory covering 13 CVEs |
before 2.6.26-15lenny2, plus listed versions 2.6.26-132.6.26-13lenny22.6.26-13lenny2~bpo40+12.6.26-142.6.26-152.6.26-15lenny12.6.26-15~bpo40+12.6.26-15~bpo40+2 |
2.6.26-15lenny2 |
user-mode-linuxDebian:5.0 From an advisory covering 13 CVEs |
before 2.6.26-1um-2+15lenny2, plus listed versions 2.6.26-1um-22.6.26-1um-2+15 |
2.6.26-1um-2+15lenny2 |
kernel-rtRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debugRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debug-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debug-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debuginfo-commonRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-docRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-rt-traceRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-trace-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-trace-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-vanillaRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-vanilla-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-vanilla-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Linux Kernel 2.6.x - 'seccomp' System Call Security Bypass | 2009-03-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0835 is a low vulnerability (CVSS 3.6) in Linux Kernel, published March 6, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. No source names a fixed version.
References
secunia.com/advisories/35390
scarybeastsecurity.blogspot.com/2009/02/linux-kernel-minor-seccomp.html
mandriva.com/security/advisories?name=MDVSA-2009:118
marc.info?l=oss-security&m=123597627132485&w=2
lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.html
Show 45 moreShow less
scary.beasts.org/security/CESA-2009-001.html
ubuntu.com/usn/usn-751-1
securityfocus.com/bid/33948
lkml.org/lkml/2009/2/28/23
debian.org/security/2009/dsa-1800
bugzilla.redhat.com/show_bug.cgi?id=487255
redhat.com/support/errata/RHSA-2009-0451.html
nvd.nist.gov/vuln/detail/CVE-2009-0835
github.com/advisories/GHSA-x75x-89gj-wfcm
access.redhat.com/errata/RHSA-2009:0451
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0451.json
cve.org/CVERecord?id=CVE-2008-4307