Description
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | fai-kernels | 1.17+etch.24etch4 | DSA-1872-1 |
| Debian 4.0 | linux-2.6 | 2.6.18.dfsg.1-24etch4 | DSA-1872-1 |
| Debian 4.0 | user-mode-linux | 2.6.18-1um-2etch.24etch4 | DSA-1872-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-128.7.1.el5 | RHSA-2009:1222 |
| RHEL 4 | kernel +10 | 2.6.9-89.0.9.EL | RHSA-2009:1223 |
| RHEL 3 | kernel +8 | 2.4.21-60.EL | RHSA-2009:1233 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5.2 EUS | kernel +12 | 2.6.18-92.1.28.el5 | RHSA-2009:1457 |
| RHEL 4.7 EUS | kernel +10 | 2.6.9-78.0.27.EL | RHSA-2009:1469 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- Linux Kernel < 2.6.19 (x86/x64) - 'udp_sendmsg' Local Privilege Escalation (2) EDB-9574 · local · Sep 2, 2009 · verified
- Linux Kernel < 2.6.19 (Debian 4) - 'udp_sendmsg' Local Privilege Escalation (3) EDB-9575 · local · Sep 2, 2009 · verified
- Linux Kernel 2.6 < 2.6.19 (White Box 4 / CentOS 4.4/4.5 / Fedora Core 4/5/6 x86) - 'ip_append_data()' Ring0 Privilege Escalation (1) EDB-9542 · local · Aug 31, 2009 · verified
GitHub 1 repository
-
xiaoxiaoleo/CVE-2009-2698 ★ 29 · Feb 16, 2018
CVE-2009-2698 compiled for CentOS 4.8
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2009:1469 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:1457 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:1233 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:1222 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2009:1223 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-1872-1 fai-kernels linux-2.6 user-mode-linux - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2009:1233 vendor-advisory
- RHSA-2009:1223 vendor-advisory
- 20100625 VMSA-2010-0010 ESX 3.5 third party update for Service Console kernel mailing-list
- 37298 third-party-advisory
- 1022761 vdb-entry
- 36430 third-party-advisory
- SUSE-SA:2009:046 vendor-advisory
- oval:org.mitre.oval:def:11514 vdb-entry signature
- 36510 third-party-advisory
- 37471 third-party-advisory
- RHSA-2009:1222 vendor-advisory
- USN-852-1 vendor-advisory
- 23073 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 36108 vdb-entry
- [oss-security] 20090825 CVE-2009-2698 kernel: udp socket NULL ptr dereference mailing-list
- MDVSA-2011:051 vendor-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- http://support.avaya.com/css/P8/documents/100067254
- oval:org.mitre.oval:def:9142 vdb-entry signature
- oval:org.mitre.oval:def:8557 vdb-entry signature
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1e0c14f49d6b393179f423abbac47f85618d3d46
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.19
- ADV-2009-3316 vdb-entry
- 37105 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=518034