Description
Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to cause a denial of service (service outage) via vectors that trigger a call with crafted arguments.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | udev | 0.125-7+lenny1 | DSA-1772-1 |
| Debian 4.0 | udev | 0.105-4etch1 | DSA-1772-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | py3-udev +1 | No fix yet | — |
Advisories 1
- DSA-1772-1 udev - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20090417 rPSA-2009-0063-1 udev mailing-list
- http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063
- 34801 third-party-advisory
- 1022068 vdb-entry
- SUSE-SA:2009:020 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=495052
- SSA:2009-111-01 vendor-advisory
- FEDORA-2009-3712 vendor-advisory
- DSA-1772 vendor-advisory
- GLSA-200904-18 vendor-advisory
- https://launchpad.net/bugs/cve/2009-1186
- MDVSA-2009:103 vendor-advisory
- 34776 third-party-advisory
- 34731 third-party-advisory
- 34753 third-party-advisory
- 34785 third-party-advisory
- 34787 third-party-advisory
- FEDORA-2009-3711 vendor-advisory
- 34539 vdb-entry
- ADV-2009-1053 vdb-entry
- USN-758-1 vendor-advisory
- 34771 third-party-advisory
- 34750 third-party-advisory
- http://wiki.rpath.com/Advisories:rPSA-2009-0063
- http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=662c3110803bd8c1aedacc36788e6fd028944314