bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Critical hole in the Linux kernel affects all versions since 2001

Summary

In 2009 Tavis Ormandy and Julien Tinnes from Google found a hole that affected all Linux kernels 2.4 and 2.6 since May 2001 and allowed local root privileges. With rarely used protocols such as Bluetooth, PPPoX or ISDN, pointers in the socket operations remained uninitialised, which could be exploited via sock_sendpage. Brad Spengler published the exploit “wunderbar_emporium”, which worked on a current Ubuntu 8.10.

Ideas

  • Unimplemented socket operations should have pointed to safe default functions.
  • A null pointer dereference in the kernel could be used for privilege escalation.
  • The kernel developers fixed the shared function instead of each protocol individually.
  • Setting mmap_min_addr to a value greater than zero prevented the exploit.

Insights

  • Rarely used code ages unnoticed and remains vulnerable for years.
  • Protection mechanisms that catch entire classes of bugs also work against unknown holes.

Facts

  • Versions 2.4.4 to 2.4.37.4 and 2.6.0 to 2.6.30.4 were affected.
  • The hole is known as CVE-2009-2692.

References

Critique

  • The report explains the cause well but does not say which distributions already set mmap_min_addr by default.

Remarks

  • Modern kernels prohibit mappings at address zero by default, so null pointer bugs usually only cause crashes now.

Recommendations

  • Check with sysctl vm.mmap_min_addr that the value is greater than zero.
  • Block kernel modules for protocols such as Bluetooth, PPPoX or ISDN on servers that do not need them.

Read the original article

Search the Web Archive

hß · 2009

Fixes for security hole in the Linux kernel [second update]

In August 2009 kernels 2.6.27.30 and 2.6.30.5 appeared, closing a hole that had existed since 2001 through which normal users could gain root privileges. Debian and Fedora delivered updates immediately and Ubuntu followed a day later, while Red Hat and SUSE initially only offered workarounds. Red Hat recommended disabling the affected network protocols, which rendered the public exploit ineffective.

hß · 2025

Google Chrome: critical security hole in web browser

In August 2025 Google closed a critical hole in Chrome (CVE-2025-9478), a use-after-free bug in the WebGL backend ANGLE. Attackers could exploit the memory bug via prepared websites, which usually leads to the execution of malicious code. The hole was fixed in Chrome 139.0.7258.154/155; Chromium-based browsers such as Edge are likely to be affected as well.

hß · 2022

Takeover possible: DrayTek routers with critical security hole

In 2022 Trellix found a critical hole (CVE-2022-32548, CVSS 10.0) in numerous DrayTek routers through which unauthenticated attackers could take over the devices. A logic error in the length check on the login page /cgi-bin/wlogin.cgi led to a buffer overflow, exploitable from the LAN or via the internet if management was reachable there. The researchers found more than 200,000 vulnerable devices on the net.