CVE-2009-2692
High · 7.8CVSS
7.8
EPSS
14.6%
Published
Aug 14, 2009
CISA due date
—
The record
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:4.0 | fai-kernels | 0 | 1.17+etch.24etch3 |
| Debian:4.0 | linux-2.6 | 0 | 2.6.18.dfsg.1-24etch3 |
| Debian:4.0 | linux-2.6.24 | 0 | 2.6.24-6~etchnhalf.8etch3 |
| Debian:4.0 | user-mode-linux | 0 | 2.6.18-1um-2etch.24etch3 |
| Debian:5.0 | linux-2.6 | 0 | 2.6.26-17lenny2 |
| Red Hat:enterprise_linux:3::as | kernel | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-BOOT | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-debuginfo | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-doc | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-hugemem | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-hugemem-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-smp | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-smp-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-source | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::as | kernel-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-BOOT | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-debuginfo | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-doc | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-hugemem | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-hugemem-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-smp | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-smp-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-source | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::desktop | kernel-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-BOOT | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-debuginfo | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-doc | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-hugemem | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-hugemem-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-smp | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-smp-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-source | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::es | kernel-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-BOOT | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-debuginfo | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-doc | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-hugemem | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-hugemem-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-smp | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-smp-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-source | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:3::ws | kernel-unsupported | 0 | 0:2.4.21-60.EL |
| Red Hat:enterprise_linux:4::as | kernel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-debuginfo | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-doc | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-hugemem | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-hugemem-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-largesmp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-largesmp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-smp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-smp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-xenU | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::as | kernel-xenU-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-debuginfo | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-doc | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-hugemem | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-hugemem-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-largesmp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-largesmp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-smp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-smp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-xenU | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::desktop | kernel-xenU-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-debuginfo | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-doc | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-hugemem | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-hugemem-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-largesmp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-largesmp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-smp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-smp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-xenU | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::es | kernel-xenU-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-debuginfo | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-doc | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-hugemem | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-hugemem-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-largesmp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-largesmp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-smp | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-smp-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-xenU | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:4::ws | kernel-xenU-devel | 0 | 0:2.6.9-89.0.9.EL |
| Red Hat:enterprise_linux:5::client | kernel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-PAE | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-PAE-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-PAE-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-debug | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-debug-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-debug-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-debuginfo-common | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-doc | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-headers | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-kdump | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-kdump-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-kdump-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-xen | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-xen-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::client | kernel-xen-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-PAE | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-PAE-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-PAE-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-debug | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-debug-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-debug-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-debuginfo-common | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-doc | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-headers | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-kdump | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-kdump-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-kdump-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-xen | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-xen-debuginfo | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_linux:5::server | kernel-xen-devel | 0 | 0:2.6.18-128.7.1.el5 |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-debug | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-debug-debuginfo | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-debug-devel | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-debuginfo | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-debuginfo-common | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-devel | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-doc | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-trace | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-trace-debuginfo | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-trace-devel | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-vanilla | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-vanilla-debuginfo | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:enterprise_mrg:1::el5 | kernel-rt-vanilla-devel | 0 | 0:2.6.24.7-132.el5rt |
| Red Hat:rhel_eus:4.7::as | kernel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-debuginfo | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-doc | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-hugemem | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-hugemem-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-largesmp | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-largesmp-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-smp | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-smp-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-xenU | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::as | kernel-xenU-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-debuginfo | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-doc | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-hugemem | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-hugemem-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-largesmp | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-largesmp-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-smp | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-smp-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-xenU | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:4.7::es | kernel-xenU-devel | 0 | 0:2.6.9-78.0.27.EL |
| Red Hat:rhel_eus:5.2 | kernel | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-PAE | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-PAE-debuginfo | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-PAE-devel | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-debug | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-debug-debuginfo | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-debug-devel | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-debuginfo | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-debuginfo-common | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-devel | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-doc | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-headers | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-kdump | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-kdump-debuginfo | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-kdump-devel | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-xen | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-xen-debuginfo | 0 | 0:2.6.18-92.1.28.el5 |
| Red Hat:rhel_eus:5.2 | kernel-xen-devel | 0 | 0:2.6.18-92.1.28.el5 |
Related vulnerabilities
- CVE-2009-1385 Integer underflow in the e1000_clean_rx_irq function in drivers/net/e1000/e1000_main.c in… Also affects fai-kernels
- CVE-2009-0065 Buffer overflow in net/sctp/sm_statefuns.c in the Stream Control Transmission Protocol… Also affects fai-kernels
- CVE-2009-3726 The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client in the Linux kernel… Also affects linux-2.6
- CVE-2007-1357 The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x before 2.6.21, and… Also affects linux-2.6
- CVE-2009-3613 The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel… Also affects linux-2.6.24
- CVE-2010-1173 The sctp_process_unk_param function in net/sctp/sm_make_chunk.c in the Linux kernel… Also affects linux-2.6
- CVE-2006-2444 The snmp_trap_decode function in the SNMP NAT helper for Linux kernel before 2.6.16.18… Also affects kernel
- CVE-2005-0815 Multiple "range checking flaws" in the ISO9660 filesystem handler in Linux 2.6.11 and… Also affects kernel