CVE-2009-2692

Published: Aug 14, 2009Modified: Apr 23, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

Affected (13)

Products: Linux: Linux Kernel · Debian: Debian Linux · Suse: Linux Enterprise Real Time · +1 more

Show all products

Linux: Linux Kernel · Debian: Debian Linux · Suse: Linux Enterprise Real Time · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Server Aus, Enterprise Linux Workstation

1 product

1 product

1 product

Linux Enterprise Real Time

Redhat

5 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Workstation

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 2.4.4 to 2.4.37.5
Linux Linux Kernel	From 2.6.0 to 2.6.30.5

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Real Time	Version 10

Configuration D

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 4.0
Redhat Enterprise Linux Desktop	Version 5.0
Redhat Enterprise Linux Eus	Version 4.8
Redhat Enterprise Linux Eus	Version 5.3
Redhat Enterprise Linux Server	Version 4.0
Redhat Enterprise Linux Server	Version 5.0
Redhat Enterprise Linux Server Aus	Version 5.3
Redhat Enterprise Linux Workstation	Version 4.0
Redhat Enterprise Linux Workstation	Version 5.0

Related CWEs

CWE-908

Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

References (78)

http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html

Source: cve@mitre.org

Broken LinkExploit

http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html

Source: cve@mitre.org

ExploitIssue Tracking

http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3

Source: cve@mitre.org

Broken Link

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98

Source: cve@mitre.org

Broken Link

http://grsecurity.net/~spender/wunderbar_emporium.tgz

Source: cve@mitre.org

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html

Source: cve@mitre.org

Mailing List

http://rhn.redhat.com/errata/RHSA-2009-1222.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2009-1223.html

Source: cve@mitre.org

Third Party Advisory

http://secunia.com/advisories/36278

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/36289

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/36327

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/36430

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/37298

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/37471

Source: cve@mitre.org

Broken LinkVendor Advisory

http://support.avaya.com/css/P8/documents/100067254

Source: cve@mitre.org

Third Party Advisory

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2009/dsa-1865

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.exploit-db.com/exploits/19933

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://www.exploit-db.com/exploits/9477

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2009:233

Source: cve@mitre.org

Broken Link

http://www.openwall.com/lists/oss-security/2009/08/14/1

Source: cve@mitre.org

Mailing ListPatch

http://www.redhat.com/support/errata/RHSA-2009-1233.html

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/archive/1/505751/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/505912/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/512019/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/36038

Source: cve@mitre.org

Broken LinkExploitThird Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2009/2272

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

http://www.vupen.com/english/advisories/2009/3316

Source: cve@mitre.org

Broken LinkVendor Advisory

http://zenthought.org/content/file/android-root-2009-08-16-source

Source: cve@mitre.org

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=516949

Source: cve@mitre.org

Issue TrackingPatch

https://issues.rpath.com/browse/RPL-3103

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657

Source: cve@mitre.org

Broken Link

http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html