Read the docs
TI-2009-02773 Aliases CVE-2009-2911GHSA-pq5x-qrx9-87q4

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain…

Priority LOW 11CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow, or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables, related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records.

Why it matters now

EPSS 0.00457 39th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:systemtap:systemtap:1.0:*:*:*:*:*:*:*1.0VulnerableSystemtap
  • cpe:2.3:a:systemtap:systemtap:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Systemtap

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-2911
  2. 2026-10-03 Alias added: GHSA-pq5x-qrx9-87q4

References

Exploit 1

Patch 1

Advisory 3

Other 2

  • TI-2009-04053 stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands… CVSS 2.0HIGH 10.0
  • TI-2010-03925 The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before… CVSS 2.0HIGH 7.2
  • TI-2010-00391 stap-server in SystemTap 1.1 does not properly restrict the value of the -B (aka BUILD)… CVSS 2.0HIGH 7.5
  • TI-2009-00748 Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local… CVSS 2.0MEDIUM 6.3
  • TI-2012-00810 SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled… CVSS 2.0MEDIUM 5.4
  • TI-2010-00390 Multiple integer signedness errors in the (1) __get_argv and (2) __get_compat_argv… CVSS 2.0MEDIUM 4.9
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences