CveMateVulnerability intelligence

CVE-2009-2692: debian debian_linux Use of Uninitialized Resource

Modified

AliasesDSA-1862-1DSA-1864-1

Published 14-08-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-2692 is a high (CVSS 7.8) Use of Uninitialized Resource vulnerability in debian debian_linux. EPSS estimates a 14.63% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities. 12 public exploits are recorded.

Priority

Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 19-07-2012)

Source freshness unavailable

How is this decided?

CVSS score

7.8/10

010

High · v3.1 (NVD)

EPSS score

14.63%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits12reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 7 · Duplicates 1

DSA-1865-1 RHSA-2009:1222 RHSA-2009:1223 RHSA-2009:1233 RHSA-2009:1239 RHSA-2009:1457+2 more

Timeline

14-08-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

CVSS metrics

2 scores · 1 source · 2 versions

v3.17.8v2.07.2

EPSS trend

Probability

14.63%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

No change 0.00 pp

From 14.63% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

12 found

referenceUnverified
Exploit Reference (archives.neohapsis.com)
Maturity: unknown
referenceUnverified
Exploit Reference (blog.cr0.org)
Maturity: unknown
referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown

Show all 12 exploits

exploit-databaselocalandroidVerified
Linux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege Escalation
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.4.4 < 2.4.37.4 / 2.6.0 < 2.6.30.4 - 'Sendpage' Local Privilege Escalation (Metasploit)
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Local Privilege Escalation
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.4/2.6 (Fedora 11) - 'sock_sendpage()' Local Privilege Escalation (2)
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 < 11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' Ring0 Privilege Escalation (5)
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3)
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)
Maturity: weaponized
exploit-databaselocallinuxVerified
Linux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4)
Maturity: weaponized
MetasploitremoteVerified
Linux Kernel Sendpage Local Privilege Escalation
exploit/linux/local/sock_sendpage
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-908Use of Uninitialized ResourceThe product uses or accesses a resource that has not been initialized.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat5 products

Debian3 products

linux-2.6< 2.6.26-17lenny2
linux-2.6.24< 2.6.24-6~etchnhalf.8etch3
debian_linuxEOL4.0

Linux1 product

linux_kernel≥ 2.4.4, < 2.4.37.5 | ≥ 2.6.0, < 2.6.30.5

Suse1 product

linux_enterprise_real_time10

4 vendors · 10 products

References

39 links

www.redhat.com/support/errata/RHSA-2009-1233.htmlVendor AdvisoryX Refsource REDHATBroken Link
secunia.com/advisories/36278Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.debian.org/security/2009/dsa-1865Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2009-1223.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/archive/1/512019/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5X Refsource CONFIRMBroken LinkVendor Advisory
secunia.com/advisories/37298Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
wiki.rpath.com/wiki/Advisories:rPSA-2009-0121X Refsource CONFIRMBroken Link
secunia.com/advisories/36430Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
secunia.com/advisories/37471Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory

Show all 39 references

rhn.redhat.com/errata/RHSA-2009-1222.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.htmlMailing ListX Refsource FULLDISCBroken LinkExploit
bugzilla.redhat.com/show_bug.cgi?id=516949X Refsource CONFIRMIssue TrackingPatch
issues.rpath.com/browse/RPL-3103X Refsource CONFIRMBroken Link
www.vmware.com/security/advisories/VMSA-2009-0016.htmlX Refsource CONFIRMThird Party Advisory
www.exploit-db.com/exploits/19933ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.vupen.com/english/advisories/2009/2272VDB EntryX Refsource VUPENBroken LinkPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing List
www.securityfocus.com/archive/1/505751/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
git.kernel.orgX Refsource CONFIRMBroken Link
secunia.com/advisories/36289Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
secunia.com/advisories/36327Third Party AdvisoryX Refsource SECUNIABroken LinkVendor Advisory
support.avaya.com/css/P8/documents/100067254X Refsource CONFIRMThird Party Advisory
grsecurity.net/~spender/wunderbar_emporium.tgzX Refsource MISCBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591VDB EntrySignatureX Refsource OVALBroken Link
git.kernel.orgX Refsource CONFIRMBroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526VDB EntrySignatureX Refsource OVALBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2009:233Vendor AdvisoryX Refsource MANDRIVABroken Link
www.exploit-db.com/exploits/9477ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.htmlX Refsource MISCExploitIssue Tracking
www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6X Refsource CONFIRMBroken LinkVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657VDB EntrySignatureX Refsource OVALBroken Link
www.openwall.com/lists/oss-security/2009/08/14/1Mailing ListX Refsource MLISTPatch
www.securityfocus.com/bid/36038VDB EntryX Refsource BIDBroken LinkExploitThird Party Advisory
www.securityfocus.com/archive/1/505912/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
zenthought.org/content/file/android-root-2009-08-16-sourceX Refsource MISCBroken Link
www.vupen.com/english/advisories/2009/3316VDB EntryX Refsource VUPENBroken LinkVendor Advisory
www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5X Refsource CONFIRMBroken LinkVendor Advisory