CVE-2009-4536
published 2010-01-12CVE-2009-4536: drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain…
PriorityP340high7.8CVSS 2.0
AVNACLAuNCNINAC
EPSS
5.23%
91.6th percentile
drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | <= 2.6.32.3 | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_workstation | — | — |
| vmware | vsphere | — | — |
CVSS provenance
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware hosted product updates, ESX patches and VI Client update resolve multiple security issues
vendor_vmware·2011-06-02·CVSS 7.8
CVE-2009-3080 [HIGH] VMware hosted product updates, ESX patches and VI Client update resolve multiple security issues
VMSA-2011-0009: VMware hosted product updates, ESX patches and VI Client update resolve multiple security issues
a. VMware vmkernel third party e1000(e) Driver Packet Filter Bypass There is an issue in the e1000(e) Linux driver for Intel PRO/1000 adapters that allows a remote attacker to bypass packet filters. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-4536 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product ============= Product Version ======= Running on ======= Replace with/ Apply Patch ================= VMware Product ============= vCenter Product Version ======= any Running on ======= Windows Replace with/ Apply Patch ===
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2010-02-05·CVSS 7.8
CVE-2009-4031 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Amerigo Wang and Eric Sesterhenn discovered that the HFS and ext4
filesystems did not correctly check certain disk structures. If a user
were tricked into mounting a specially crafted filesystem, a remote
attacker could crash the system or gain root privileges. (CVE-2009-4020,
CVE-2009-4308)
It was discovered that FUSE did not correctly check certain requests.
A local attacker with access to FUSE mounts could exploit this to
crash the system or possibly gain root privileges. Ubuntu 9.10 was not
affected. (CVE-2009-4021)
It was discovered that KVM did not correctly decode certain guest
instructions. A local attacker in a guest could exploit this to
trigger high scheduling latency in the host, leading to a denial o
Red Hat
kernel: e1000 issue reported at 26c3
vendor_redhat·2009-12-28·CVSS 7.8
CVE-2009-4536 [HIGH] kernel: e1000 issue reported at 26c3
kernel: e1000 issue reported at 26c3
drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
GHSA
GHSA-f8hp-66pw-jmc7: drivers/net/e1000/e1000_main
ghsa_unreviewed·2022-05-02·CVSS 7.8
CVE-2009-4536 [HIGH] GHSA-f8hp-66pw-jmc7: drivers/net/e1000/e1000_main
drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload. NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-4536 kernel: e1000 issue reported at 26c3
bugzilla·2010-01-04·CVSS 7.8
CVE-2009-4536 [HIGH] CVE-2009-4536 kernel: e1000 issue reported at 26c3
CVE-2009-4536 kernel: e1000 issue reported at 26c3
Description of problem:
This was disclosed at 26c3.
Fabian mentioned that CVE-2009-1385 has an incorrect fix. The fix he points to
is http://git.kernel.org/linus/ea30e11970a96cfe5e32c03a29332554573b4a10
Which fixes a DoS when the frame spans multiple buffers and the last buffer
contains less than four bytes. However, if that last fragment is longer than 4
bytes, it will actually be taken into account while the previous fragments will
have been ignored. This means we can end up in a situation where a single
Ethernet frame has multiple interpretation since at some level it will be
considered as a whole and in others the N first bytes will be silently
discarded.
References:
http://events.ccc.de/congress/2009/Fahrplan//events/3596.en.html
Bugzilla
CVE-2009-4537 kernel: r8169 issue reported at 26c3
bugzilla·2009-12-28·CVSS 7.8
CVE-2009-4537 [HIGH] CVE-2009-4537 kernel: r8169 issue reported at 26c3
CVE-2009-4537 kernel: r8169 issue reported at 26c3
Description of problem:
This was disclosed at 26c3.
Fabian also mentioned the fix for CVE-2009-1389 regarding the r8169 driver introduces a similar security problem as this: http://git.kernel.org/linus/fdd7b4c3302c93f6833e338903ea77245eb510b4
- RTL_W16(RxMaxSize, 16383);
+ RTL_W16(RxMaxSize, rx_buf_sz);
is actually a revert of this:
http://git.kernel.org/linus/126fa4b9ca5d9d7cb7d46f779ad3bd3631ca387c
- /* For gigabit rtl8169, MTU + header + CRC + VLAN */
- RTL_W16(RxMaxSize, tp->rx_buf_sz);
+ /* Low hurts. Let's disable the filtering. */
+ RTL_W16(RxMaxSize, 16383);
The accompanying comment for the original commit (126fa):
The size of the incoming frame is not correctly checked.
The RxMaxSize register (0xDA) does not work as expect
http://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.htmlhttp://marc.info/?t=126203102000001&r=1&w=2http://secunia.com/advisories/35265http://secunia.com/advisories/38031http://secunia.com/advisories/38276http://secunia.com/advisories/38296http://secunia.com/advisories/38492http://secunia.com/advisories/38610http://secunia.com/advisories/38779http://securitytracker.com/id?1023420http://www.debian.org/security/2010/dsa-1996http://www.debian.org/security/2010/dsa-2005http://www.openwall.com/lists/oss-security/2009/12/28/1http://www.openwall.com/lists/oss-security/2009/12/29/2http://www.openwall.com/lists/oss-security/2009/12/31/1http://www.redhat.com/support/errata/RHSA-2010-0019.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0020.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0041.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0053.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0111.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0882.htmlhttp://www.securityfocus.com/bid/37519http://www.vmware.com/security/advisories/VMSA-2011-0009.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=552126https://exchange.xforce.ibmcloud.com/vulnerabilities/55648https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10607https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12440https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13226https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7453https://rhn.redhat.com/errata/RHSA-2010-0095.htmlhttp://blog.c22.cc/2009/12/27/26c3-cat-procsysnetipv4fuckups/http://events.ccc.de/congress/2009/Fahrplan/events/3596.en.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.htmlhttp://marc.info/?t=126203102000001&r=1&w=2http://secunia.com/advisories/35265http://secunia.com/advisories/38031http://secunia.com/advisories/38276http://secunia.com/advisories/38296http://secunia.com/advisories/38492http://secunia.com/advisories/38610http://secunia.com/advisories/38779http://securitytracker.com/id?1023420http://www.debian.org/security/2010/dsa-1996http://www.debian.org/security/2010/dsa-2005http://www.openwall.com/lists/oss-security/2009/12/28/1http://www.openwall.com/lists/oss-security/2009/12/29/2http://www.openwall.com/lists/oss-security/2009/12/31/1http://www.redhat.com/support/errata/RHSA-2010-0019.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0020.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0041.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0053.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0111.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0882.htmlhttp://www.securityfocus.com/bid/37519http://www.vmware.com/security/advisories/VMSA-2011-0009.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=552126https://exchange.xforce.ibmcloud.com/vulnerabilities/55648https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10607https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12440https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13226https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7453https://rhn.redhat.com/errata/RHSA-2010-0095.html
2010-01-12
Published