High severity · published Aug 14, 2009
CVE-2009-2692
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local…
7.8
CVSS
14.6%
EPSS
No
On KEV
Description
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)14.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.4.4 before 2.4.37.5; 2.6.0 before 2.6.30.5 · source: NVD
DL
Debian Linux · Debian
4.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
4.0; 5.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
4.8; 5.3 · source: NVD
EL
Enterprise Linux Server · Redhat
4.0; 5.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
5.3 · source: NVD
EL
Enterprise Linux Workstation · Redhat
4.0; 5.0 · source: NVD
LE
Linux Enterprise Real Time · Suse
10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2692
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2692
Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.html
Exploit
http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html
Broken Link
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3
Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98
Broken Link
http://grsecurity.net/~spender/wunderbar_emporium.tgz
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability