CVE-2009-4538: Critical severity linux kernel vulnerability
Description of problem: Similar to the second issue that Fab mentioned in his presentation at 26c3, this affects the e1000e driver. See https://bugzilla.redhat.com/showbug.cgi?id=550907#c0 issue #2 for the description, and this https://bugzilla.redhat.com/showbug.cgi?id=550907#c4. This bug is filed to make sure we fix this too.
http://www.securityfocus.com/bid/37523
Other sources
drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-4538?
CVE-2009-4538 has a moderate severity level as it can allow remote attackers to exploit vulnerabilities through crafted packets.
How do I fix CVE-2009-4538?
To mitigate CVE-2009-4538, you should upgrade to a kernel version that is later than 2.6.32.3 or apply relevant patches provided by your distribution.
What versions are affected by CVE-2009-4538?
CVE-2009-4538 affects the Linux kernel versions up to and including 2.6.32.3.
Is CVE-2009-4538 related to other vulnerabilities?
Yes, CVE-2009-4538 is related to CVE-2009-4537, indicating a broader issue with the e1000e driver.
What type of threat does CVE-2009-4538 pose?
CVE-2009-4538 poses a threat by allowing attackers to potentially disrupt network communication through oversized Ethernet frames.