CVE-2009-2692

Linux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege Escalation

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

El kernel de Linux versiones 2.6.0 hasta 2.6.30.4 y 2.4.4 hasta 2.4.37.4, no inicia todos los punteros de función para operaciones de socket en estructuras de proto_ops, lo que permite a los usuarios locales activar una desreferencia de puntero NULL y alcanzar privilegios mediante el uso de mmap que asigna la página cero, inserta el código arbitrario en esta página y luego invoca una operación no disponible, como es demostrado por la operación de sendpage (función sock_sendpage) en un socket PF_PPPOX.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-08-05 CVE Reserved
2009-08-14 CVE Published
2009-08-14 First Exploit
2024-02-09 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-476: NULL Pointer Dereference
CWE-908: Use of Uninitialized Resource

CAPEC

References (49)

URL	Tag	Source
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3	Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98	Broken Link
http://grsecurity.net/~spender/wunderbar_emporium.tgz	Broken Link
http://support.avaya.com/css/P8/documents/100067254	Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121	Broken Link
http://www.securityfocus.com/archive/1/505751/100/0/threaded	Broken Link
http://www.securityfocus.com/archive/1/505912/100/0/threaded	Broken Link
http://www.securityfocus.com/archive/1/507985/100/0/threaded	Broken Link
http://www.securityfocus.com/archive/1/512019/100/0/threaded	Broken Link
http://www.vmware.com/security/advisories/VMSA-2009-0016.html	Third Party Advisory
http://zenthought.org/content/file/android-root-2009-08-16-source	Broken Link
https://issues.rpath.com/browse/RPL-3103	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657	Broken Link

URL	Date	SRC
https://www.exploit-db.com/exploits/9477	2009-08-18
https://www.exploit-db.com/exploits/19933	2012-07-19
https://www.exploit-db.com/exploits/9545	2009-08-31
https://www.exploit-db.com/exploits/9598	2009-09-09
https://www.exploit-db.com/exploits/9479	2009-08-24
https://www.exploit-db.com/exploits/9641	2009-09-11
https://www.exploit-db.com/exploits/9435	2009-08-14
https://www.exploit-db.com/exploits/9436	2009-08-14
https://github.com/jdvalentini/CVE-2009-2692	2018-07-12
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html	2024-08-07
http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html	2024-08-07
http://www.exploit-db.com/exploits/19933	2024-08-07
http://www.exploit-db.com/exploits/9477	2024-08-07
http://www.securityfocus.com/bid/36038	2024-08-07

URL	Date	SRC
http://www.openwall.com/lists/oss-security/2009/08/14/1	2024-02-08
http://www.vupen.com/english/advisories/2009/2272	2024-02-08
https://bugzilla.redhat.com/show_bug.cgi?id=516949	2009-09-30

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html	2024-02-08
http://rhn.redhat.com/errata/RHSA-2009-1222.html	2024-02-08
http://rhn.redhat.com/errata/RHSA-2009-1223.html	2024-02-08
http://secunia.com/advisories/36278	2024-02-08
http://secunia.com/advisories/36289	2024-02-08
http://secunia.com/advisories/36327	2024-02-08
http://secunia.com/advisories/36430	2024-02-08
http://secunia.com/advisories/37298	2024-02-08
http://secunia.com/advisories/37471	2024-02-08
http://www.debian.org/security/2009/dsa-1865	2024-02-08
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5	2024-02-08
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5	2024-02-08
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6	2024-02-08
http://www.mandriva.com/security/advisories?name=MDVSA-2009:233	2024-02-08
http://www.redhat.com/support/errata/RHSA-2009-1233.html	2024-02-08
http://www.vupen.com/english/advisories/2009/3316	2024-02-08
https://access.redhat.com/security/cve/CVE-2009-2692	2009-09-30

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 2.4.4 < 2.4.37.5 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.4.4 < 2.4.37.5"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				>= 2.6.0 < 2.6.30.5 Search vendor "Linux" for product "Linux Kernel" and version " >= 2.6.0 < 2.6.30.5"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				4.0 Search vendor "Debian" for product "Debian Linux" and version "4.0"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Real Time Search vendor "Suse" for product "Linux Enterprise Real Time"				10 Search vendor "Suse" for product "Linux Enterprise Real Time" and version "10"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				4.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Desktop Search vendor "Redhat" for product "Enterprise Linux Desktop"				5.0 Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "5.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Eus Search vendor "Redhat" for product "Enterprise Linux Eus"				4.8 Search vendor "Redhat" for product "Enterprise Linux Eus" and version "4.8"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Eus Search vendor "Redhat" for product "Enterprise Linux Eus"				5.3 Search vendor "Redhat" for product "Enterprise Linux Eus" and version "5.3"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				4.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Search vendor "Redhat" for product "Enterprise Linux Server"				5.0 Search vendor "Redhat" for product "Enterprise Linux Server" and version "5.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Server Aus Search vendor "Redhat" for product "Enterprise Linux Server Aus"				5.3 Search vendor "Redhat" for product "Enterprise Linux Server Aus" and version "5.3"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				4.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Workstation Search vendor "Redhat" for product "Enterprise Linux Workstation"				5.0 Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "5.0"		-		Affected