CVE-2009-3621: Medium severity linux kernel vulnerability
net/unix/afunix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AFUNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.
Other sources
Quoting from the patch submitted: "...a deadlock bug in UNIX domain socket, which makes able to DoS attack against the local machine by non-root users.
... Why this happens: Error checks between unixsocketconnect() and unixwaitforpeer() are inconsistent. The former calls the latter to wait until the backlog is processed. Despite the latter returns without doing anything when the socket is shutdown, the former doesn't check the shutdown state and just retries calling the latter forever."
How to reproduce: 1. Make a listening AFUNIX/SOCKSTREAM socket with an abstruct namespace(), and shutdown(2) it. 2. Repeat connect(2)ing to the listening socket from the other sockets until the connection backlog is full-filled. 3. connect(2) takes the CPU forever. If every core is taken, the system hangs.
Reproducer: http://patchwork.kernel.org/patch/54678/
You will need to add in the missing header files: #include <string.h> #include <stdio.h> #include <sys/un.h> #include <sys/types.h> #include <sys/socket.h>
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3621?
CVE-2009-3621 has a high severity rating due to its potential to cause a denial of service by hanging the system.
How do I fix CVE-2009-3621?
To fix CVE-2009-3621, upgrade your Linux kernel to a version later than 2.6.31.4.
Which versions of Linux are affected by CVE-2009-3621?
CVE-2009-3621 affects Linux kernel versions 2.6.31.4 and earlier, along with specific releases of Ubuntu, Fedora, openSUSE, and SUSE Linux Enterprise.
What type of vulnerability is CVE-2009-3621?
CVE-2009-3621 is classified as a denial of service vulnerability that affects abstract-namespace AF_UNIX sockets.
Can local users exploit CVE-2009-3621?
Yes, local users can exploit CVE-2009-3621 by creating specific AF_UNIX sockets to cause the system to hang.