National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2009-2692 Detail

Current Description

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

Source:  MITRE      Last Modified:  08/14/2009      View Analysis Description

Quick Info

CVE Dictionary Entry:
CVE-2009-2692
Original release date:
08/14/2009
Last revised:
09/18/2017
Source:
US-CERT/NIST

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:
7.2 HIGH
Vector:
(AV:L/AC:L/Au:N/C:C/I:C/A:C) (legend)
Impact Subscore:
10.0
Exploitability Subscore:
3.9
CVSS Version 2 Metrics:
Access Vector:
Locally exploitable
Access Complexity:
Low
Authentication:
Not required to exploit
Impact Type:
Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (09/14/2009)

Red Hat is aware of this issue. Please see http://kbase.redhat.com/faq/docs/DOC-18065. Updates for Red Hat Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG to correct this issue are available: https://rhn.redhat.com/cve/CVE-2009-2692.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html Exploit External Source FULLDISC 20090813 Linux NULL pointer dereference due to incorrect proto_ops initializations
http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html External Source MISC http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=c18d0fe535a73b219f960d1af3d0c264555a12e3 External Source CONFIRM http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git;a=commit;h=c18d0fe535a73b219f960d1af3d0c264555a12e3
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98 External Source CONFIRM http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e694958388c50148389b0e9b9e9e8945cf0f1b98
http://grsecurity.net/~spender/wunderbar_emporium.tgz External Source MISC http://grsecurity.net/~spender/wunderbar_emporium.tgz
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html External Source SUSE SUSE-SR:2009:015
http://rhn.redhat.com/errata/RHSA-2009-1222.html External Source REDHAT RHSA-2009:1222
http://rhn.redhat.com/errata/RHSA-2009-1223.html External Source REDHAT RHSA-2009:1223
http://support.avaya.com/css/P8/documents/100067254 External Source CONFIRM http://support.avaya.com/css/P8/documents/100067254
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121 External Source CONFIRM http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121
http://www.debian.org/security/2009/dsa-1865 External Source DEBIAN DSA-1865
http://www.exploit-db.com/exploits/19933 External Source EXPLOIT-DB 19933
http://www.exploit-db.com/exploits/9477 External Source EXPLOIT-DB 9477
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5 Vendor Advisory External Source CONFIRM http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5 Vendor Advisory External Source CONFIRM http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6 Vendor Advisory External Source CONFIRM http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6
http://www.mandriva.com/security/advisories?name=MDVSA-2009:233 External Source MANDRIVA MDVSA-2009:233
http://www.openwall.com/lists/oss-security/2009/08/14/1 External Source MLIST [oss-security] 20090814 CVE-2009-2692 kernel: uninit op in SOCKOPS_WRAP() leads to privesc
http://www.redhat.com/support/errata/RHSA-2009-1233.html External Source REDHAT RHSA-2009:1233
http://www.securityfocus.com/archive/1/archive/1/505751/100/0/threaded Exploit External Source BUGTRAQ 20090813 Linux NULL pointer dereference due to incorrect proto_ops initializations
http://www.securityfocus.com/archive/1/archive/1/505912/100/0/threaded External Source BUGTRAQ 20090818 rPSA-2009-0121-1 kernel open-vm-tools
http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded External Source BUGTRAQ 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components
http://www.securityfocus.com/archive/1/archive/1/512019/100/0/threaded External Source BUGTRAQ 20100625 VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel
http://www.securityfocus.com/bid/36038 Exploit External Source BID 36038
http://www.vmware.com/security/advisories/VMSA-2009-0016.html External Source CONFIRM http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/2272 Patch; Vendor Advisory External Source VUPEN ADV-2009-2272
http://www.vupen.com/english/advisories/2009/3316 Vendor Advisory External Source VUPEN ADV-2009-3316
http://zenthought.org/content/file/android-root-2009-08-16-source External Source MISC http://zenthought.org/content/file/android-root-2009-08-16-source
https://bugzilla.redhat.com/show_bug.cgi?id=516949 External Source CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=516949
https://issues.rpath.com/browse/RPL-3103 External Source CONFIRM https://issues.rpath.com/browse/RPL-3103
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526 External Source OVAL oval:org.mitre.oval:def:11526
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591 External Source OVAL oval:org.mitre.oval:def:11591
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657 External Source OVAL oval:org.mitre.oval:def:8657

References to Check Content

Identifier:
oval:org.mitre.oval:def:11526
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11526
Identifier:
oval:org.mitre.oval:def:11591
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11591
Identifier:
oval:org.mitre.oval:def:8657
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:8657

Technical Details

Vulnerability Type (View All)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
OR
cpe:2.3:a:linux:kernel:2.6.24.7:*:*:*:*:*:*:*
cpe:2.3:a:linux:kernel:2.6.25.15:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.8:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.9:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.11:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.12:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.13:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.14:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.15:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.16:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.17:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-1:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-2:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-3:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-4:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-5:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-6:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-7:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:pre-8:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.18:*:x86:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.19:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.19:*:-pre1:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.19:*:-pre2:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.19:*:-pre3:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.19:*:-pre4:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.19:*:-pre5:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.19:*:-pre6:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.20:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.21:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.21:*:-pre1:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.21:*:-pre4:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.21:*:-pre7:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.22:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.23:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.23:*:-ow2:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.23:*:-pre9:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.24:*:-ow1:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.25:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.26:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.27:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.27:*:-pre1:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.27:*:-pre2:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.27:*:-pre3:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.27:*:-pre4:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.27:*:-pre5:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.28:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.29:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.29:-rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.29:-rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.30:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.30:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.30:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.31:-pre1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.32:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.32:-pre1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.32:-pre2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.33:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.33:p-re1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.33.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.33.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.33.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.33.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.33.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.34:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.35.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.36.8:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.37:-rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.4.37.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.1:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.3:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.4:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.5:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.6:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.8:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.9:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.10:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.11:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.11.12:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12.1:*:*:*:*:*:*:*
Showing 100 of 160 CPEs, view all CPEs here.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History 3 change records found - show changes