7.8
CVE-2009-2692
- EPSS 18.38%
- Published 14.08.2009 15:16:27
- Last modified 09.04.2025 00:30:58
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.4.4 < 2.4.37.5
Linux ≫ Linux Kernel Version >= 2.6.0 < 2.6.30.5
Debian ≫ Debian Linux Version4.0
Suse ≫ Linux Enterprise Real Time Version10
Redhat ≫ Enterprise Linux Desktop Version4.0
Redhat ≫ Enterprise Linux Desktop Version5.0
Redhat ≫ Enterprise Linux Eus Version4.8
Redhat ≫ Enterprise Linux Eus Version5.3
Redhat ≫ Enterprise Linux Server Version4.0
Redhat ≫ Enterprise Linux Server Version5.0
Redhat ≫ Enterprise Linux Server Aus Version5.3
Redhat ≫ Enterprise Linux Workstation Version4.0
Redhat ≫ Enterprise Linux Workstation Version5.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 18.38% | 0.95 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 7.2 | 3.9 | 10 |
AV:L/AC:L/Au:N/C:C/I:C/A:C
|
CWE-908 Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.