CVE-2009-3001

EPSS 1.0%

The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel 2.6.31-rc7 and earlier does not initialize a certain data structure, which allows local users to read the contents of some kernel memory locations by calling getsockname on an AF_LLC socket.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/9513unverified exploitdbwww.exploit-db.com/exploits/9513unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=28e9fc592cb8c7a43e4d3147b38be6032a0e81bc http://jon.oberheide.org/files/llc-getsockname-leak.c https://bugzilla.redhat.com/show_bug.cgi?id=519305 http://secunia.com/advisories/37105 https://exchange.xforce.ibmcloud.com/vulnerabilities/52732 http://www.exploit-db.com/exploits/9513 http://www.openwall.com/lists/oss-security/2009/08/26/1 http://www.securityfocus.com/bid/36126 http://www.ubuntu.com/usn/USN-852-1