NetSight
IP …
high7.8Public exploit code

CVE-2009-2692

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, w…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.4.4 before 2.4.37.5
from 2.6.0 before 2.6.30.5
DebianDebian Linux
Version 4.0
SuseLinux Enterprise Real Time
Version 10
RedhatEnterprise Linux Desktop
Versions 4.0, 5.0
RedhatEnterprise Linux Eus
Versions 4.8, 5.3
RedhatEnterprise Linux Server
Versions 4.0, 5.0
RedhatEnterprise Linux Server Aus
Version 5.3
RedhatEnterprise Linux Workstation
Versions 4.0, 5.0

Weakness classification

CWE-908

References