VULNERABILITY INTELLIGENCE
CVE-2009-2692
CVSS score7.8 HIGH
EPSS probability14.63%
CISA KEVNot currently listed
Published2009-08-14
Last modified2026-06-16
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Weakness classification
- nvd@nist.gov: CWE-908
Primary references
- cve@mitre.org — Broken Link, Exploit
- cve@mitre.org — Exploit, Issue Tracking
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link
- cve@mitre.org — Broken Link
- cve@mitre.org — Mailing List
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Third Party Advisory
- cve@mitre.org — Broken Link, Vendor Advisory
- cve@mitre.org — Broken Link, Vendor Advisory
- cve@mitre.org — Broken Link, Vendor Advisory
- cve@mitre.org — Broken Link, Vendor Advisory