Published: 27/08/2009 Updated: 28/12/2023

CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 736

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel prior to 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
canonical ubuntu linux 6.06
canonical ubuntu linux 9.04
canonical ubuntu linux 8.04
canonical ubuntu linux 8.10
suse linux enterprise server 9
suse linux enterprise server 10
suse linux enterprise desktop 10
fedoraproject fedora 10
redhat enterprise linux server 5.0
redhat enterprise linux workstation 5.0
redhat enterprise linux desktop 4.0
redhat enterprise linux desktop 5.0
redhat enterprise linux server 4.0
redhat enterprise linux workstation 4.0
redhat enterprise linux server aus 5.3
redhat enterprise linux eus 5.3
redhat enterprise linux eus 4.8
vmware esxi 4.0
vmware vcenter server 4.0

Solar Designer discovered that the z90crypt driver did not correctly check capabilities A local attacker could exploit this to shut down the device, leading to a denial of service Only affected Ubuntu 606 (CVE-2009-1883) ...

/*********************************************************** * hoagie_udp_sendmsgc * LOCAL LINUX KERNEL ROOT EXPLOIT (< 2619) - CVE-2009-2698 * * udp_sendmsg bug exploit via (*output) callback function * used in dst_entry / rtable * * Bug reported by Tavis Ormandy and Julien Tinnes * of the Google Security Team * * Tested with Debi ...

/* ** ** 0x82-CVE-2009-2698 ** Linux kernel 26 < 2619 (32bit) ip_append_data() local ring0 root exploit ** ** Tested White Box 4(269-5ELsmp), ** CentOS 44(269-42ELsmp), CentOS 45(269-55ELsmp), ** Fedora Core 4(2611-11369_FC4smp), Fedora Core 5(2615-12054_FC5), ** Fedora Core 6(2618-12798fc6) ** ** -- ** Discovered by Tav ...

/* second verse, same as the first CVE-2009-2698 udp_sendmsg(), x86/x64 Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at NULL and finding it executed This exploit is a bit more nuanced and thoughtful ;) use /therebelsh for everything At this moment, when each of us must fit an arrow to his bow and ente ...

Linux 26 kernel versions below 2619 32bit ip_append_data() ring() root exploit ...

Linux 26 kernels prior to version 2619 udp_sendmsg local root exploit ...

CVE-2009-2698 compiled for CentOS 4.8

CVE-2009-2698 CVE-2009-2698 compiled for CentOS 48 githubcom/SecWiki/linux-kernel-exploits/tree/4dca098e7491efc83903494d7c00f24c843aae99/2009/CVE-2009-2698 Detail [hacker@localhost ~]$ id uid=500(hacker) gid=500(hacker) groups=500(hacker) context=user_u:system_r:unconfined_t [hacker@localhost ~]$ gcc 36108c -o exp [hacker@localhost ~]$ /exp sh-300# id uid=0(root

Some kernel exploit i wrote

Some kernel exploits i wrote: CVE-2009-2692-sock_sendpagec CVE-2009-2698-udp_sendmsgc Intel_sysretc can_bcm_expc csawc nfs_mountc perf_expc perf_stackc

CWE-476 http://rhn.redhat.com/errata/RHSA-2009-1223.html http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19 http://secunia.com/advisories/36430 http://rhn.redhat.com/errata/RHSA-2009-1222.html https://bugzilla.redhat.com/show_bug.cgi?id=518034 http://secunia.com/advisories/23073 http://www.securitytracker.com/id?1022761 http://www.openwall.com/lists/oss-security/2009/08/25/1 http://secunia.com/advisories/36510 http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00008.html http://www.securityfocus.com/bid/36108 http://www.redhat.com/support/errata/RHSA-2009-1233.html http://support.avaya.com/css/P8/documents/100067254 http://www.vupen.com/english/advisories/2009/3316 http://www.vmware.com/security/advisories/VMSA-2009-0016.html http://secunia.com/advisories/37471 http://secunia.com/advisories/37298 http://www.mandriva.com/security/advisories?name=MDVSA-2011:051 http://secunia.com/advisories/37105 http://www.ubuntu.com/usn/USN-852-1 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9142 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8557 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11514 http://www.securityfocus.com/archive/1/512019/100/0/threaded http://www.securityfocus.com/archive/1/507985/100/0/threaded http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1e0c14f49d6b393179f423abbac47f85618d3d46 https://usn.ubuntu.com/852-1/https://nvd.nist.gov https://www.exploit-db.com/exploits/9575/

CVE-2009-2698

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect