CVE-2009-2692

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

• CWE-908

• http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.htmlBroken Link, Exploit
• http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.htmlExploit, Issue Tracking
• http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3Broken Link
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98Broken Link
• http://grsecurity.net/~spender/wunderbar_emporium.tgzBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlMailing List
• http://rhn.redhat.com/errata/RHSA-2009-1222.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2009-1223.htmlThird Party Advisory
• http://secunia.com/advisories/36278Broken Link, Vendor Advisory
• http://secunia.com/advisories/36289Broken Link, Vendor Advisory
• http://secunia.com/advisories/36327Broken Link, Vendor Advisory
• http://secunia.com/advisories/36430Broken Link, Vendor Advisory
• http://secunia.com/advisories/37298Broken Link, Vendor Advisory
• http://secunia.com/advisories/37471Broken Link, Vendor Advisory
• http://support.avaya.com/css/P8/documents/100067254Third Party Advisory
• http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121Broken Link
• http://www.debian.org/security/2009/dsa-1865Mailing List, Third Party Advisory
• http://www.exploit-db.com/exploits/19933Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/9477Third Party Advisory, VDB Entry
• http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5Broken Link, Vendor Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5Broken Link, Vendor Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6Broken Link, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:233Broken Link
• http://www.openwall.com/lists/oss-security/2009/08/14/1Mailing List, Patch
• http://www.redhat.com/support/errata/RHSA-2009-1233.htmlBroken Link
• http://www.securityfocus.com/archive/1/505751/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/505912/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/507985/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/512019/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/36038Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlThird Party Advisory
• http://www.vupen.com/english/advisories/2009/2272Broken Link, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/3316Broken Link, Vendor Advisory
• http://zenthought.org/content/file/android-root-2009-08-16-sourceBroken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=516949Issue Tracking, Patch
• https://issues.rpath.com/browse/RPL-3103Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657Broken Link
• http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0174.htmlBroken Link, Exploit
• http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.htmlExploit, Issue Tracking
• http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.4.37.y.git%3Ba=commit%3Bh=c18d0fe535a73b219f960d1af3d0c264555a12e3Broken Link
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e694958388c50148389b0e9b9e9e8945cf0f1b98Broken Link
• http://grsecurity.net/~spender/wunderbar_emporium.tgzBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.htmlMailing List
• http://rhn.redhat.com/errata/RHSA-2009-1222.htmlThird Party Advisory
• http://rhn.redhat.com/errata/RHSA-2009-1223.htmlThird Party Advisory
• http://secunia.com/advisories/36278Broken Link, Vendor Advisory
• http://secunia.com/advisories/36289Broken Link, Vendor Advisory
• http://secunia.com/advisories/36327Broken Link, Vendor Advisory
• http://secunia.com/advisories/36430Broken Link, Vendor Advisory
• http://secunia.com/advisories/37298Broken Link, Vendor Advisory
• http://secunia.com/advisories/37471Broken Link, Vendor Advisory
• http://support.avaya.com/css/P8/documents/100067254Third Party Advisory
• http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0121Broken Link
• http://www.debian.org/security/2009/dsa-1865Mailing List, Third Party Advisory
• http://www.exploit-db.com/exploits/19933Exploit, Third Party Advisory, VDB Entry
• http://www.exploit-db.com/exploits/9477Third Party Advisory, VDB Entry
• http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.5Broken Link, Vendor Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.30.5Broken Link, Vendor Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.31-rc6Broken Link, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2009:233Broken Link
• http://www.openwall.com/lists/oss-security/2009/08/14/1Mailing List, Patch
• http://www.redhat.com/support/errata/RHSA-2009-1233.htmlBroken Link
• http://www.securityfocus.com/archive/1/505751/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/505912/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/507985/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/512019/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/36038Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlThird Party Advisory
• http://www.vupen.com/english/advisories/2009/2272Broken Link, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2009/3316Broken Link, Vendor Advisory
• http://zenthought.org/content/file/android-root-2009-08-16-sourceBroken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=516949Issue Tracking, Patch
• https://issues.rpath.com/browse/RPL-3103Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11526Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11591Broken Link
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8657Broken Link

Published

Aug 14, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-2686Unspecified vulnerability in HP NonStop G06.12.00 through G0…
• CVE-2009-2687The exif_read_data function in the Exif module in PHP before…
• CVE-2009-2688Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4…
• CVE-2009-2689JDK13Services.getProviders in Sun Java SE 5.0 before Update …
• CVE-2009-2690The encoder in Sun Java SE 6 before Update 15, and OpenJDK, …
• CVE-2009-2691The mm_for_maps function in fs/proc/base.c in the Linux kern…
• CVE-2009-2693Directory traversal vulnerability in Apache Tomcat 5.5.0 thr…
• CVE-2009-2694The msn_slplink_process_msg function in libpurple/protocols/…
• CVE-2009-2695The Linux kernel before 2.6.31-rc7 does not properly prevent…
• CVE-2009-2696Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp…
• CVE-2009-2697The Red Hat build script for the GNOME Display Manager (GDM)…
• CVE-2009-2698The udp_sendmsg function in the UDP implementation in (1) ne…7.8