Description
Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-19lenny1 | DSA-1915-1 |
| Debian 4.0 | linux-2.6.24 | 2.6.24-6~etchnhalf.9etch1 | DSA-1928-1 |
Advisories 2
- DSA-1915-1 linux-2.6 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1928-1 linux-2.6.24 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20090917 Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams mailing-list
- 36379 vdb-entry
- SUSE-SA:2009:061 vendor-advisory
- USN-852-1 vendor-advisory
- 36707 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=522331
- MDVSA-2009:329 vendor-advisory
- [oss-security] 20090914 CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams mailing-list
- SUSE-SA:2010:012 vendor-advisory
- 37909 third-party-advisory
- SUSE-SA:2009:064 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git%3Ba=commit%3Bh=ffcfb8db540ff879c2a85bf7e404954281443414
- SUSE-SA:2010:013 vendor-advisory
- 37105 third-party-advisory
- [oss-security] 20090914 Re: CVE-2009-2903 kernel: appletalk: denial of service when handling IP tunnelled over DDP datagrams mailing-list