$ cve CVE-2009-3002 JSON

CVE-2009-3002 EXPLOIT

4.9

MEDIUM · CVSS 2.0 · EPSS 1% (pctl 63)

Patch early

A public exploit exists.

Description

The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket, related to the econet_getname function in net/econet/af_econet.c; (4) an AF_NETROM socket, related to the nr_getname function in net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket, related to the raw_getname function in net/can/raw.c.

Scoring

CVSS	4.9 (MEDIUM, v2.0)
Vector	AV:L/AC:L/Au:N/C:C/I:N/A:N
EPSS	1.03% — more likely to be exploited than 63% of all CVEs
Weakness	CWE-200
On CISA KEV	no
Public exploit	yes
Published	2009-08-28
Last modified	2026-06-16

Affected (2)

Vendor	Product
canonical	ubuntu linux
linux	linux kernel

Public exploits

Source	Title	Date
exploit-db	Linux Kernel < 2.6.31-rc7 - 'AF_IRDA' 29-Byte Stack Disclosure (2)	2009-08-31
exploit-db	Linux Kernel 2.6.30 - 'atalk_getname()' 8-bytes Stack Disclosure (1)	2009-08-26

References

→ the Explorer · watch your stack · NVD