CVE-2009-1897

Published: Jul 20, 2009Modified: Apr 23, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.

Affected (9)

Products: Linux: Linux Kernel

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Version 2.6.30.1
Linux Linux Kernel	Version 2.6.30
Linux Linux Kernel	Version 2.6.30 rc1
Linux Linux Kernel	Version 2.6.30 rc2
Linux Linux Kernel	Version 2.6.30 rc3
Linux Linux Kernel	Version 2.6.30 rc4
Linux Linux Kernel	Version 2.6.30 rc5
Linux Linux Kernel	Version 2.6.30 rc6
Linux Linux Kernel	Version 2.6.30 rc7-git6

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (26)

http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html

Source: secalert@redhat.com

http://article.gmane.org/gmane.linux.network/124939

Source: secalert@redhat.com

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13

Source: secalert@redhat.com

http://grsecurity.net/~spender/cheddar_bay.tgz

Source: secalert@redhat.com

Patch

http://isc.sans.org/diary.html?storyid=6820

Source: secalert@redhat.com

Exploit

http://lkml.org/lkml/2009/7/6/19

Source: secalert@redhat.com

Exploit

http://secunia.com/advisories/35839

Source: secalert@redhat.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2009/07/17/1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1925

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=512284

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/51803

Source: secalert@redhat.com

https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations

Source: secalert@redhat.com

http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://article.gmane.org/gmane.linux.network/124939

Source: af854a3a-2127-422b-91ae-364da2661108

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13

Source: af854a3a-2127-422b-91ae-364da2661108

http://grsecurity.net/~spender/cheddar_bay.tgz

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

http://isc.sans.org/diary.html?storyid=6820

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://lkml.org/lkml/2009/7/6/19

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://secunia.com/advisories/35839

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.openwall.com/lists/oss-security/2009/07/17/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2009/1925

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=512284

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/51803

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.