CVE-2009-2692
published 2009-08-14CVE-2009-2692: The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures…
PriorityP275high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
14.63%
96.3th percentile
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| linux | linux_kernel | >= 2.4.4 < 2.4.37.5 | 2.4.37.5 |
| linux | linux_kernel | >= 2.6.0 < 2.6.30.5 | 2.6.30.5 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_real_time | — | — |
| vmware | esxi | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
ff 25 [4 bytes ptr] [4 bytes fn_ptr] (x86 JMP [mem] trampoline at page zero)
bytes↗
ff 25 [4 bytes ptr] (x86 JMP [mem] at address 0x00000000)
- →Exploit maps page zero (address 0x0 / NULL) using mmap(2) with MAP_FIXED to place shellcode/trampoline; detect mmap calls with addr=0 and MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE flags from unprivileged processes. ↗
- →Exploit triggers the vulnerability via sendfile() syscall on a socket of type PF_BLUETOOTH or PF_APPLETALK (SOCK_DGRAM) as the output fd; monitor sendfile() calls where the destination fd is a raw socket of these protocol families. ↗
- →Exploit also uses PF_PPPOX sockets as the vulnerable sendpage target; monitor socket() calls for PF_PPPOX domain from unprivileged users. ↗
- →Exploit drops and executes a binary at /tmp/sendpage; monitor for creation and execution of files matching /tmp/sendpage or /tmp/sendfile.* by non-root users. ↗
- →Exploit reads /proc/kallsyms or /proc/ksyms to resolve kernel symbol addresses; alert on unprivileged processes opening these files, especially in conjunction with mmap(NULL) calls. ↗
- →x86 trampoline shellcode placed at page zero starts with bytes 0xFF 0x25 (JMP [mem]) followed by a pointer to the privilege-escalation function; scan memory at address 0x0 for this byte pattern when mmap_min_addr is 0. ↗
- →Exploit uses personality(0xffffffff) to check for PER_SVR4 and falls back to mprotect on address 0x0; monitor personality() syscalls with 0xffffffff argument followed by mprotect on address 0. ↗
- →Post-exploitation step spawns an interactive shell via execl("/bin/sh","sh","-i"); correlate with preceding sendfile()+socket(PF_BLUETOOTH/PF_APPLETALK) activity for full kill-chain detection. ↗
- ·The Metasploit module targets Linux x86 only; x86_64 support is commented out in the module code. ↗
- ·The exploit may require the __attribute__((regparm(3))) to be removed for 2.4 kernels. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j86m-g62r-5g7r: The Linux kernel 2
ghsa_unreviewed·2022-05-02
CVE-2009-2692 [HIGH] CWE-119 GHSA-j86m-g62r-5g7r: The Linux kernel 2
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
VulnCheck
Linux Kernel Use of Uninitialized Resource
vulncheck·2009·CVSS 7.8
CVE-2009-2692 [HIGH] Linux Kernel Use of Uninitialized Resource
Linux Kernel Use of Uninitialized Resource
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://flare.io/learn/resources/blog/old-school-irc-new-victims-inside-the-newly-discovered-sshstalker-li
VMware
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
vendor_vmware·2009-11-20·CVSS 5.0
CVE-2007-2052 [MEDIUM] VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
VMSA-2009-0016: VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
a. JRE Security Update JRE update to version 1.5.0_20, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_20: CVE-2009-
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2009-08-19
CVE-2009-2692 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: Linux kernel vulnerability
Tavis Ormandy and Julien Tinnes discovered that Linux did not correctly
initialize certain socket operation function pointers. A local attacker
could exploit this to gain root privileges. By default, Ubuntu 8.04
and later with a non-zero /proc/sys/vm/mmap_min_addr setting were not
vulnerable.
Instructions: After a standard system upgrade you need to reboot your computer to
effect the necessary changes.
Red Hat
kernel: uninit op in SOCKOPS_WRAP() leads to privesc
vendor_redhat·2009-08-13·CVSS 7.8
CVE-2009-2692 [HIGH] CWE-456 kernel: uninit op in SOCKOPS_WRAP() leads to privesc
kernel: uninit op in SOCKOPS_WRAP() leads to privesc
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Statement: Red Hat is aware of this issue. Please see https://access.redhat.com/articles/18053.
No detection rules found.
Exploit-DB
Linux Kernel 2.4.4 < 2.4.37.4 / 2.6.0 < 2.6.30.4 - 'Sendpage' Local Privilege Escalation (Metasploit)
exploitdb·2012-07-19
CVE-2009-2692 Linux Kernel 2.4.4 < 2.4.37.4 / 2.6.0 < 2.6.30.4 - 'Sendpage' Local Privilege Escalation (Metasploit)
Linux Kernel 2.4.4 'Linux Kernel Sendpage Local Privilege Escalation',
'Description' => %q{
AKA Wunderbar Emporium
},
'License' => MSF_LICENSE,
'Author' =>
[
'spender', # wunderbar_emporium.tgz
'rcvalle', # sock_sendpage.c
'egypt' # metasploit module
],
'Platform' => [ 'linux' ],
'Arch' => [ ARCH_X86 ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'References' =>
[
[ 'CVE', '2009-2692' ],
[ 'URL', 'http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html' ],
[ 'URL', 'http://www.grsecurity.net/~spender/wunderbar_emporium2.tgz' ],
],
'Targets' =>
[
[ 'Linux x86', { 'Arch' => ARCH_X86 } ],
#[ 'Linux x64', { 'Arch' => ARCH_X86_64 } ],
],
'DefaultTarget' => 0,
}
))
end
def exploit
sc = Metasm::ELF.new(@cpu)
sc.parse %Q|
#define DEBUGGING
#define NULL ((void*)0)
#ifdef __ELF__
.
Exploit-DB
Linux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3)
exploitdb·2009-09-11
CVE-2009-2692 Linux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3)
Linux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3)
---
This third version features: Complete support for i386, x86_64, ppc and ppc64; The
personality trick published by Tavis Ormandy and Julien Tinnes; The TOC
pointer workaround for data items addressing on ppc64 (i.e. functions
on exploit code and libc can be referenced); Improved search and
transition to SELinux types with mmap_zero permission.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9641.tar.gz (2009-linux-sendpage3.tar.gz)
# milw0rm.com [2009-09-11]
Exploit-DB
Linux Kernel 2.4/2.6 (Fedora 11) - 'sock_sendpage()' Local Privilege Escalation (2)
exploitdb·2009-09-09
CVE-2009-2692 Linux Kernel 2.4/2.6 (Fedora 11) - 'sock_sendpage()' Local Privilege Escalation (2)
Linux Kernel 2.4/2.6 (Fedora 11) - 'sock_sendpage()' Local Privilege Escalation (2)
---
This is the second version of Linux sock_sendpage() NULL pointer
dereference exploit. Now, it also works with Linux kernel versions
which implements COW credentials (e.g. Fedora 11). For SELinux enforced
systems, it automatically searches in the SELinux policy rules for
types with mmap_zero permission it can transition, and tries to exploit
the system with that types.
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9598.tar.gz (2009-linux-sendpage2.tar.gz)
# milw0rm.com [2009-09-09]
Exploit-DB
Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Local Privilege Escalation
exploitdb·2009-08-31
CVE-2009-2692 Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Local Privilege Escalation
Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Local Privilege Escalation
---
/*
* Linux sock_sendpage() NULL pointer dereference
* Copyright 2009 Ramon de Carvalho Valle
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public Licen
Exploit-DB
Linux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 < 11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' Ring0 Privilege Escalation (5)
exploitdb·2009-08-24·CVSS 7.8
CVE-2009-2692 [HIGH] Linux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 < 11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' Ring0 Privilege Escalation (5)
Linux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 ,
** Przemyslaw Frasunek .
** --
** exploit by .
**
** "Slow and dirty exploit for this one"
**
*/
#include
#include
#include
#include
#include
#include
unsigned int uid, gid;
void kernel_code()
{
unsigned long where=0;
unsigned long *pcb_task_struct;
where=(unsigned long )&where;
where&=~8191;
pcb_task_struct=(unsigned long *)where;
while(pcb_task_struct){
if(pcb_task_struct[0]==uid&&pcb_task_struct[1]==uid&&
pcb_task_struct[2]==uid&&pcb_task_struct[3]==uid&&
pcb_task_struct[4]==gid&&pcb_task_struct[5]==gid&&
pcb_task_struct[6]==gid&&pcb_task_struct[7]==gid){
pcb_task_struct[0]=pcb_task_struct[1]=pcb_task_struct[2]=pcb_task_struct[3]=0;
pcb_task_struct[4]=pcb_task_struct[5]=pcb_task_struct[6]=pcb_task_struct[7]=0;
break;
}
pcb_task
Exploit-DB
Linux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege Escalation
exploitdb·2009-08-18·CVSS 7.8
CVE-2009-2692 [HIGH] Linux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege Escalation
Linux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege Escalation
---
Source for exploiting CVE-2009-2692 on Android; Hole is closed in Android kernels released August 2009 or later.
http://zenthought.org/content/file/android-root-2009-08-16-source
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9477.tar.gz (android-root-20090816.tar.gz)
# milw0rm.com [2009-08-18]
Exploit-DB
Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)
exploitdb·2009-08-14
CVE-2009-2692 Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)
Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)
---
/* dedicated to my best friend in the whole world, Robin Price
the joke is in your hands
just too easy -- some nice library functions for reuse here though
credits to julien tinnes/tavis ormandy for the bug
may want to remove the __attribute__((regparm(3))) for 2.4 kernels,
I have no time to test
spender@www:~$ cat redhat_hehe
I bet Red Hat will wish they closed the SELinux vulnerability when they
were given the opportunity to. Now all RHEL boxes will get owned by
leeches.c :p
fd7810e34e9856f77cba67f291ba115f33411ebd
d4b0e413ebf15d039953dfabf7f9a2d1
thanks to Dan Walsh for the great SELinux bypass even on "fixed" SELinux
policies
and nice work Linus on trying to silently fix an 8 year old
vulnerabilit
Exploit-DB
Linux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4)
exploitdb·2009-08-14
CVE-2009-2692 Linux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4)
Linux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4)
---
> Linux NULL pointer dereference due to incorrect proto_ops initializations
> > -------------------------------------------------------------------------
Quick and dirty exploit for this one:
http://www.frasunek.com/proto_ops.tgz
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/9436.tgz (2009-proto_ops.tgz)
# milw0rm.com [2009-08-14]
Metasploit
Linux Kernel Sendpage Local Privilege Escalation
metasploit
Linux Kernel Sendpage Local Privilege Escalation
Linux Kernel Sendpage Local Privilege Escalation
The Linux kernel failed to properly initialize some entries in the proto_ops struct for several protocols, leading to NULL being dereferenced and used as a function pointer. By using mmap(2) to map page 0, an attacker can execute arbitrary code in the context of the kernel. Several public exploits exist for this vulnerability, including spender's wunderbar_emporium and rcvalle's ppc port, sock_sendpage.c. All Linux 2.4/2.6 versions since May 2001 are believed to be affected: 2.4.4 up to and including 2.4.37.4; 2.6.0 up to and including 2.6.30.4 This module has been tested successfully on CentOS 5.0 (i386) with kernel version 2.6.18-8.1.1.tl5; and Debian 3.1r8 Sarge (i686) with kernel version 2.4.27-3-386.
CWE
Missing Initialization of a Variable
mitre_cwe
CWE-456 Missing Initialization of a Variable
CWE-456: Missing Initialization of a Variable
The product does not initialize critical variables, which causes the execution environment to use unexpected values.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Other. Impact: Unexpected State, Quality Degradation, Varies by Context. The uninitialized data may be invalid, causing logic errors within the program. In some cases, this could result in a security problem.
Detection Methods:
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, th
CWE
Improper Initialization
mitre_cwe
CWE-665 Improper Initialization
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
Modes of Introduction:
Phase: Implementation
Note: This weakness can occur in code paths that are not well-tested, such as rare error conditions. This is because the use of uninitialized data would be noticed as a bug during frequently-used functionality.
Phase: Operation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program
CWE
Use of Uninitialized Resource
mitre_cwe
CWE-908 Use of Uninitialized Resource
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. The uninitialized resource may contain values that cause program flow to change in ways that t
CWE
NULL Pointer Dereference
mitre_cwe
CWE-476 NULL Pointer Dereference
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Scope: Integrity, Confidentiality. Impact: Execute Unauthorized Code or Commands, Read Memory, Modify Memory. In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code ex
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.htmlhttp://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.htmlhttp://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98http://grsecurity.net/~spender/wunderbar_emporium.tgzhttp://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1222.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1223.htmlhttp://secunia.com/advisories/36278http://secunia.com/advisories/36289http://secunia.com/advisories/36327http://secunia.com/advisories/36430http://secunia.com/advisories/37298http://secunia.com/advisories/37471http://support.avaya.com/css/P8/documents/100067254http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121http://www.debian.org/security/2009/dsa-1865http://www.exploit-db.com/exploits/19933http://www.exploit-db.com/exploits/9477http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6http://www.mandriva.com/security/advisories?name=MDVSA-2009:233http://www.openwall.com/lists/oss-security/2009/08/14/1http://www.redhat.com/support/errata/RHSA-2009-1233.htmlhttp://www.securityfocus.com/archive/1/505751/100/0/threadedhttp://www.securityfocus.com/archive/1/505912/100/0/threadedhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/archive/1/512019/100/0/threadedhttp://www.securityfocus.com/bid/36038http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/2272http://www.vupen.com/english/advisories/2009/3316http://zenthought.org/content/file/android-root-2009-08-16-sourcehttps://bugzilla.redhat.com/show_bug.cgi?id=516949https://issues.rpath.com/browse/RPL-3103https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.htmlhttp://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.htmlhttp://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98http://grsecurity.net/~spender/wunderbar_emporium.tgzhttp://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1222.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1223.htmlhttp://secunia.com/advisories/36278http://secunia.com/advisories/36289http://secunia.com/advisories/36327http://secunia.com/advisories/36430http://secunia.com/advisories/37298http://secunia.com/advisories/37471http://support.avaya.com/css/P8/documents/100067254http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121http://www.debian.org/security/2009/dsa-1865http://www.exploit-db.com/exploits/19933http://www.exploit-db.com/exploits/9477http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6http://www.mandriva.com/security/advisories?name=MDVSA-2009:233http://www.openwall.com/lists/oss-security/2009/08/14/1http://www.redhat.com/support/errata/RHSA-2009-1233.htmlhttp://www.securityfocus.com/archive/1/505751/100/0/threadedhttp://www.securityfocus.com/archive/1/505912/100/0/threadedhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/archive/1/512019/100/0/threadedhttp://www.securityfocus.com/bid/36038http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/2272http://www.vupen.com/english/advisories/2009/3316http://zenthought.org/content/file/android-root-2009-08-16-sourcehttps://bugzilla.redhat.com/show_bug.cgi?id=516949https://issues.rpath.com/browse/RPL-3103https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657
2009-08-14
Published
Exploited in the wild