Description
The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary kernel memory via certain getsockopt calls that trigger a NULL dereference.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +10 | 2.6.18-8.1.3.el5 | RHSA-2007:0169 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel < 2.6.20.2 - 'IPv6_Getsockopt_Sticky' Memory Leak EDB-4172 · local · Jul 10, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2007:0169 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- 22904 vdb-entry
- oval:org.mitre.oval:def:10015 vdb-entry signature
- VU#920689 third-party-advisory
- 24901 third-party-advisory
- MDKSA-2007:078 vendor-advisory
- http://bugzilla.kernel.org/show_bug.cgi?id=8134
- 24777 third-party-advisory
- SUSE-SA:2007:029 vendor-advisory
- https://issues.rpath.com/browse/RPL-1153
- http://www.wslabi.com/wabisabilabi/initPublishedBid.do?
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.2
- USN-489-1 vendor-advisory
- 24518 third-party-advisory
- ADV-2007-0907 vdb-entry
- 25099 third-party-advisory
- 20070615 rPSA-2007-0124-1 kernel xen mailing-list
- FEDORA-2007-335 vendor-advisory
- RHSA-2007:0169 vendor-advisory
- 25080 third-party-advisory
- 33025 vdb-entry
- 24493 third-party-advisory
- FEDORA-2007-336 vendor-advisory
- USN-486-1 vendor-advisory
- 25691 third-party-advisory
- 26139 third-party-advisory
- 26133 third-party-advisory