CVE-2009-1897 : The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux

The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.

Published 2009-07-20 17:30:55

Updated 2023-02-13 02:20:14

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowMemory Corruption

Products affected by CVE-2009-1897

Linux » Linux Kernel » Version: 2.6.30
cpe:2.3:o:linux:linux_kernel:2.6.30:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30 Update RC1
cpe:2.3:o:linux:linux_kernel:2.6.30:rc1:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30 Update RC3
cpe:2.3:o:linux:linux_kernel:2.6.30:rc3:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30 Update RC2
cpe:2.3:o:linux:linux_kernel:2.6.30:rc2:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30 Update RC5
cpe:2.3:o:linux:linux_kernel:2.6.30:rc5:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30 Update Rc7-git6
cpe:2.3:o:linux:linux_kernel:2.6.30:rc7-git6:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30 Update RC4 X86 32 Edition
cpe:2.3:o:linux:linux_kernel:2.6.30:rc4:x86_32:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30 Update RC6
cpe:2.3:o:linux:linux_kernel:2.6.30:rc6:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel » Version: 2.6.30.1
cpe:2.3:o:linux:linux_kernel:2.6.30.1:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2009-1897

Top countries where our scanners detected CVE-2009-1897

Top open port discovered on systems with this issue 52869

IPs affected by CVE-2009-1897 13,544

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2009-1897!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2009-1897

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-1897

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-1897

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

Vendor statements for CVE-2009-1897

Red Hat 2009-09-02

Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2009-1897 The flaw only affects the Red Hat Enterprise Linux 5.4 beta kernel, which includes a backport of the upstream bug fix introducing this flaw (git commit 33dccbb0). This issue did not affect the final released Red Hat Enterprise Linux 5.4 kernel. It is also possible to mitigate this flaw by ensuring that the permissions for /dev/net/tun is restricted to root only. This issue does not affect any other released kernel in any Red Hat product.

References for CVE-2009-1897

Jump to