Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2009-2698 — NULL Pointer Dereference in Kernel

CWE-476 — NULL Pointer Dereference12 documents9 sources
Severity
7.8HIGHNVD
EPSS
26.1%
top 3.70%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
12
Linux KernelCanonical Ubuntu LinuxFedoraproject Fedora+9 more
Timeline
PublishedAug 27
Latest updateMay 2

Description

The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages8 packages

▶NVDlinux/linux_kernel< 2.6.19

Also affects: Ubuntu Linux 6.06, 8.04, 8.10, 9.04, Enterprise Linux 4.8, 5.3, Fedora 10

Patches

Patch: www.securityfocus.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-x9j9-wxm6-8cvm: The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp↗2022-05-02
▶
CVEList
CVE-2009-2698: The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp↗2009-08-27
▶
VulnCheck
Linux Kernel NULL Pointer Dereference↗2009
▶

💥Exploits & PoCs

3
Exploit-DB
Linux Kernel < 2.6.19 (x86/x64) - 'udp_sendmsg' Local Privilege Escalation (2)↗2009-09-02
▶
Exploit-DB
Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Privilege Escalation (3)↗2009-09-02
▶
Exploit-DB
Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1)↗2009-08-31
▶

🔍Detection Rules

2
YARA
Linux_Exploit_CVE_2009_2698_12374e97↗
▶
YARA
Linux_Exploit_CVE_2009_2698_cc04dddd↗
▶

📋Vendor Advisories

2
Ubuntu
Linux kernel vulnerabilities↗2009-10-22
▶
Red Hat
kernel: udp socket NULL ptr dereference↗2009-08-24
▶

💬Community

1
Bugzilla
CVE-2009-2698 kernel: udp socket NULL ptr dereference↗2009-08-18
▶
CVE-2009-2698 — NULL Pointer Dereference in Kernel | cvebase