Skip to content
OpenAdvisories
Unscored Public exploit CVE-2009-3002 EUVD-2009-2987GHSA-6v8v-wc26-56rj

The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read t…

Published Aug 28, 2009 · Updated Aug 7, 2024 · Assigned by mitre

Description

The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket, related to the econet_getname function in net/econet/af_econet.c; (4) an AF_NETROM socket, related to the nr_getname function in net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket, related to the raw_getname function in net/can/raw.c.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 5.0 linux-2.6 2.6.26-19lenny1 DSA-1915-1
Debian 4.0 linux-2.6 2.6.18.dfsg.1-26etch1 DSA-1929-1
Debian 4.0 linux-2.6.24 2.6.24-6~etchnhalf.9etch1 DSA-1928-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 3 kernel +8 2.4.21-63.EL RHSA-2009:1550
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat MRG 1 kernel-rt +9 2.6.24.7-137.el5rt RHSA-2009:1540

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 2

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 5

References