Main Vulnerability Database Vulnerabilities #VU95733

Use of uninitialized resource in Linux kernel - CVE-2009-2692

Published: August 14, 2009 / Updated: August 10, 2024

Vulnerability identifier: #VU95733

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2009-2692

CWE-ID: CWE-908

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local user to execute arbitrary code.

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

Affected software

Linux kernel

How to mitigate CVE-2009-2692

Install update from vendor's repository.

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins

Use of uninitialized resource in Linux kernel