CVE-2009-2698: Null Pointer Dereference
Tavis Ormandy and Julien Tinnes, Google Security Team reported that Kernels <= 2.6.18.8 are vulnerable to a NULL pointer dereference issue when using MSGMORE on udp sockets.
Fixed upstream already by: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=1e0c14f49d6b393179f423abbac47f85618d3d46
Acknowledgements:
Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google Security Team for responsibly reporting this flaw.
Other sources
The udpsendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSGMORE flag and a UDP socket.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2698?
CVE-2009-2698 is rated as a critical vulnerability that may allow local users to escalate privileges or cause a denial of service.
How do I fix CVE-2009-2698?
To mitigate CVE-2009-2698, you should upgrade the Linux kernel to version 2.6.19 or later.
What systems are affected by CVE-2009-2698?
CVE-2009-2698 affects multiple versions of the Linux kernel, as well as specific distributions like Ubuntu, SUSE, and Red Hat.
Can CVE-2009-2698 lead to a system crash?
Yes, exploitation of CVE-2009-2698 can result in a NULL pointer dereference, leading to a system crash.
Is CVE-2009-2698 exploitable remotely?
CVE-2009-2698 is not directly exploitable remotely as it requires local user access to the system.