CVE-2009-3002
Description
The Linux kernel before 2.6.31-rc7 does not initialize certain data structures within getname functions, which allows local users to read the contents of some kernel memory locations by calling getsockname on (1) an AF_APPLETALK socket, related to the atalk_getname function in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket, related to the econet_getname function in net/econet/af_econet.c; (4) an AF_NETROM socket, related to the nr_getname function in net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket, related to the raw_getname function in net/can/raw.c.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
13cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*+ 3 more
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: <2.6.31
- cpe:2.3:o:linux:linux_kernel:2.6.31:-:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc1:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc2:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc3:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc4:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc5:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:2.6.31:rc6:*:*:*:*:*:*
- (no CPE)range: < 2.6.31-rc7
Patches
Vulnerability mechanics
References
24- www.securityfocus.com/bid/36150nvdExploitThird Party AdvisoryVDB Entry
- bugzilla.redhat.com/show_bug.cginvdExploitIssue TrackingThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlnvdMailing ListThird Party Advisory
- secunia.com/advisories/36438nvdThird Party Advisory
- secunia.com/advisories/37105nvdThird Party Advisory
- secunia.com/advisories/37351nvdThird Party Advisory
- www.exploit-db.com/exploits/9521nvdThird Party AdvisoryVDB Entry
- www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc7nvdVendor Advisory
- www.openwall.com/lists/oss-security/2009/08/27/1nvdMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2009/08/27/2nvdMailing ListThird Party Advisory
- www.securityfocus.com/archive/1/512019/100/0/threadednvdThird Party AdvisoryVDB Entry
- www.ubuntu.com/usn/USN-852-1nvdThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11611nvdThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11741nvdThird Party Advisory
- rhn.redhat.com/errata/RHSA-2009-1540.htmlnvdThird Party Advisory
- rhn.redhat.com/errata/RHSA-2009-1550.htmlnvdThird Party Advisory
- git.kernel.orgnvd
- git.kernel.orgnvd
- git.kernel.orgnvd
- git.kernel.orgnvd
- git.kernel.orgnvd
- git.kernel.orgnvd
News mentions
0No linked articles in our index yet.