PT-2009-3785 · Linux · Linux Kernel

Eugene Teo · Published 2009-04-06 · Updated 2024-02-15 · CVE-2009-1243

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.29.1

Description The issue is related to the "udp seq file infrastructure" in the Linux kernel. It allows local users to cause a denial of service (panic) by reading zero bytes from the /proc/net/udp file and other unspecified files due to an incorrect unlocking step.

Recommendations For Linux kernel versions prior to 2.6.29.1, update to version 2.6.29.1 or later to resolve the issue.

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2009-1243

Affected Products

Linux Kernel

References · 9

• http://vigilance.fr/vulnerability/Linux-kernel-denial-of-service-via-proc-net-udp-8586 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-1243 · Security Note
• http://openwall.com/lists/oss-security/2009/04/01/4 · Patch
• http://securityfocus.com/bid/34329 · Patch
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.29.1 · Note
• http://vupen.com/english/advisories/2009/0924 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49595 · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=30842f2989aacfaba3ccb39829b3417be9313dbe · Note
• http://secunia.com/advisories/34478 · Note