7.8
CVE-2009-2692
- EPSS 18.38%
- Veröffentlicht 14.08.2009 15:16:27
- Zuletzt bearbeitet 09.04.2025 00:30:58
- Quelle cve@mitre.org
- Teams Watchlist Login
- Unerledigt Login
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.4.4 < 2.4.37.5
Linux ≫ Linux Kernel Version >= 2.6.0 < 2.6.30.5
Debian ≫ Debian Linux Version4.0
Suse ≫ Linux Enterprise Real Time Version10
Redhat ≫ Enterprise Linux Desktop Version4.0
Redhat ≫ Enterprise Linux Desktop Version5.0
Redhat ≫ Enterprise Linux Eus Version4.8
Redhat ≫ Enterprise Linux Eus Version5.3
Redhat ≫ Enterprise Linux Server Version4.0
Redhat ≫ Enterprise Linux Server Version5.0
Redhat ≫ Enterprise Linux Server Aus Version5.3
Redhat ≫ Enterprise Linux Workstation Version4.0
Redhat ≫ Enterprise Linux Workstation Version5.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 18.38% | 0.95 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
CWE-908 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.