peter bassill · operator
$ cve CVE-2009-2692 JSON

CVE-2009-2692 EXPLOIT

7.8
HIGH · CVSS 3.1 · EPSS 14.6% (pctl 97)

Patch early

A public exploit exists.

Description

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

Scoring

CVSS7.8 (HIGH, v3.1)
VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS14.63% — more likely to be exploited than 97% of all CVEs
WeaknessCWE-908
On CISA KEVno
Public exploityes
Published2009-08-14
Last modified2026-06-16

Affected (8)

VendorProduct
debiandebian linux
linuxlinux kernel
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux workstation
suselinux enterprise real time

Public exploits

SourceTitleDate
exploit-dbLinux Kernel 2.4.4 < 2.4.37.4 / 2.6.0 < 2.6.30.4 - 'Sendpage' Local Privilege Escalation (Metasploit)2012-07-19
exploit-dbLinux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3)2009-09-11
exploit-dbLinux Kernel 2.4/2.6 (Fedora 11) - 'sock_sendpage()' Local Privilege Escalation (2)2009-09-09
exploit-dbLinux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Local Privilege Escalation2009-08-31
exploit-dbLinux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 < 11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' Ring0 Privilege Escalation (5)2009-08-24
exploit-dbLinux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege Escalation2009-08-18
exploit-dbLinux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)2009-08-14
exploit-dbLinux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4)2009-08-14

References

→ the Explorer  ·  watch your stack  ·  NVD