VulnerabilityModified

CVE-2009-2692

HIGH 7.8EPSS 14.6%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 14.6%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.

Description

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 14.63% probability · 96th percentile
CISA KEV: Not listed
Weakness: CWE-908
Affected: linux/linux kernel · debian/debian linux · suse/linux enterprise real time · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux workstation
Source: cve@mitre.org

References

http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.htmlBroken Link, Exploit
http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.htmlExploit, Issue Tracking
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98Broken Link
http://grsecurity.net/~spender/wunderbar_emporium.tgzBroken Link
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlMailing List
http://rhn.redhat.com/errata/RHSA-2009-1222.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2009-1223.htmlThird Party Advisory
http://secunia.com/advisories/36278Broken Link, Vendor Advisory
http://secunia.com/advisories/36289Broken Link, Vendor Advisory
http://secunia.com/advisories/36327Broken Link, Vendor Advisory
http://secunia.com/advisories/36430Broken Link, Vendor Advisory
http://secunia.com/advisories/37298Broken Link, Vendor Advisory
http://secunia.com/advisories/37471Broken Link, Vendor Advisory
http://support.avaya.com/css/P8/documents/100067254Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121Broken Link
http://www.debian.org/security/2009/dsa-1865Mailing List, Third Party Advisory
http://www.exploit-db.com/exploits/19933Exploit, Third Party Advisory, VDB Entry
http://www.exploit-db.com/exploits/9477Third Party Advisory, VDB Entry
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5Broken Link, Vendor Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5Broken Link, Vendor Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6Broken Link, Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2009:233Broken Link
http://www.openwall.com/lists/oss-security/2009/08/14/1Mailing List, Patch
http://www.redhat.com/support/errata/RHSA-2009-1233.htmlBroken Link
http://www.securityfocus.com/archive/1/505751/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/505912/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/507985/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/512019/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/36038Broken Link, Exploit, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.