CVE-2009-4538
published 2010-01-12CVE-2009-4538: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds…
PriorityP343critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
8.38%
94.3th percentile
drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | <= 2.6.32.3 | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2010-02-05·CVSS 7.8
CVE-2009-4031 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
Amerigo Wang and Eric Sesterhenn discovered that the HFS and ext4
filesystems did not correctly check certain disk structures. If a user
were tricked into mounting a specially crafted filesystem, a remote
attacker could crash the system or gain root privileges. (CVE-2009-4020,
CVE-2009-4308)
It was discovered that FUSE did not correctly check certain requests.
A local attacker with access to FUSE mounts could exploit this to
crash the system or possibly gain root privileges. Ubuntu 9.10 was not
affected. (CVE-2009-4021)
It was discovered that KVM did not correctly decode certain guest
instructions. A local attacker in a guest could exploit this to
trigger high scheduling latency in the host, leading to a denial o
Red Hat
kernel: e1000e frame fragment issue
vendor_redhat·2009-12-28·CVSS 7.8
CVE-2009-4538 [HIGH] kernel: e1000e frame fragment issue
kernel: e1000e frame fragment issue
drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
GHSA
GHSA-pm3r-x334-2847: drivers/net/e1000e/netdev
ghsa_unreviewed·2022-05-02·CVSS 7.8
CVE-2009-4538 [HIGH] GHSA-pm3r-x334-2847: drivers/net/e1000e/netdev
drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2009-4538 kernel: e1000e frame fragment issue
bugzilla·2009-12-29·CVSS 10.0
CVE-2009-4538 [CRITICAL] CVE-2009-4538 kernel: e1000e frame fragment issue
CVE-2009-4538 kernel: e1000e frame fragment issue
Description of problem:
Similar to the second issue that Fab mentioned in his presentation at 26c3, this affects the e1000e driver. See https://bugzilla.redhat.com/show_bug.cgi?id=550907#c0 issue #2 for the description, and this https://bugzilla.redhat.com/show_bug.cgi?id=550907#c4. This bug is filed to make sure we fix this too.
http://www.securityfocus.com/bid/37523
Discussion:
A quick heads up to all the release owners on this bug, the patch I posted upstream for bz 550915 (specifically the e1000 bits) will apply pretty cleanly to e1000e here.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2010:0019 https://rhn.redhat.com/errata/RHSA-2010-0019.html
---
This issue has been addressed
Bugzilla
CVE-2009-4537 kernel: r8169 issue reported at 26c3
bugzilla·2009-12-28·CVSS 7.8
CVE-2009-4537 [HIGH] CVE-2009-4537 kernel: r8169 issue reported at 26c3
CVE-2009-4537 kernel: r8169 issue reported at 26c3
Description of problem:
This was disclosed at 26c3.
Fabian also mentioned the fix for CVE-2009-1389 regarding the r8169 driver introduces a similar security problem as this: http://git.kernel.org/linus/fdd7b4c3302c93f6833e338903ea77245eb510b4
- RTL_W16(RxMaxSize, 16383);
+ RTL_W16(RxMaxSize, rx_buf_sz);
is actually a revert of this:
http://git.kernel.org/linus/126fa4b9ca5d9d7cb7d46f779ad3bd3631ca387c
- /* For gigabit rtl8169, MTU + header + CRC + VLAN */
- RTL_W16(RxMaxSize, tp->rx_buf_sz);
+ /* Low hurts. Let's disable the filtering. */
+ RTL_W16(RxMaxSize, 16383);
The accompanying comment for the original commit (126fa):
The size of the incoming frame is not correctly checked.
The RxMaxSize register (0xDA) does not work as expect
http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.htmlhttp://secunia.com/advisories/38031http://secunia.com/advisories/38276http://secunia.com/advisories/38296http://secunia.com/advisories/38492http://secunia.com/advisories/38610http://secunia.com/advisories/38779http://securitytracker.com/id?1023420http://www.debian.org/security/2010/dsa-1996http://www.debian.org/security/2010/dsa-2005http://www.mandriva.com/security/advisories?name=MDVSA-2010:066http://www.openwall.com/lists/oss-security/2009/12/28/1http://www.openwall.com/lists/oss-security/2009/12/29/2http://www.openwall.com/lists/oss-security/2009/12/31/1http://www.redhat.com/support/errata/RHSA-2010-0019.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0020.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0041.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0053.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0111.htmlhttp://www.securityfocus.com/bid/37523https://bugzilla.redhat.com/show_bug.cgi?id=551214https://exchange.xforce.ibmcloud.com/vulnerabilities/55645https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7016https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9702https://rhn.redhat.com/errata/RHSA-2010-0095.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-February/035159.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-01/msg00008.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.htmlhttp://secunia.com/advisories/38031http://secunia.com/advisories/38276http://secunia.com/advisories/38296http://secunia.com/advisories/38492http://secunia.com/advisories/38610http://secunia.com/advisories/38779http://securitytracker.com/id?1023420http://www.debian.org/security/2010/dsa-1996http://www.debian.org/security/2010/dsa-2005http://www.mandriva.com/security/advisories?name=MDVSA-2010:066http://www.openwall.com/lists/oss-security/2009/12/28/1http://www.openwall.com/lists/oss-security/2009/12/29/2http://www.openwall.com/lists/oss-security/2009/12/31/1http://www.redhat.com/support/errata/RHSA-2010-0019.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0020.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0041.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0053.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0111.htmlhttp://www.securityfocus.com/bid/37523https://bugzilla.redhat.com/show_bug.cgi?id=551214https://exchange.xforce.ibmcloud.com/vulnerabilities/55645https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7016https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9702https://rhn.redhat.com/errata/RHSA-2010-0095.html
2010-01-12
Published