{"id":"CVE-2009-1897","state":"PUBLISHED","title":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows ","description":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.","publishedAt":"2009-07-20T17:00:00.000Z","updatedAt":"2024-08-07T05:27:54.800Z","severity":null,"assigner":"redhat","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["http://www.vupen.com/english/advisories/2009/1925","http://isc.sans.org/diary.html?storyid=6820","http://grsecurity.net/~spender/cheddar_bay.tgz","http://www.openwall.com/lists/oss-security/2009/07/17/1","http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html","https://exchange.xforce.ibmcloud.com/vulnerabilities/51803","http://article.gmane.org/gmane.linux.network/124939","http://secunia.com/advisories/35839","http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13","https://bugzilla.redhat.com/show_bug.cgi?id=512284","http://lkml.org/lkml/2009/7/6/19","http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html","https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations"],"weaknesses":[],"ingestedAt":"2026-10-29T19:39:15.997Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2009/1xxx/CVE-2009-1897.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2009-1897","state":"PUBLISHED","datePublished":"2009-07-20T17:00:00.000Z","dateUpdated":"2024-08-07T05:27:54.800Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2009-06-02T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"http://www.vupen.com/english/advisories/2009/1925","name":"ADV-2009-1925","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://isc.sans.org/diary.html?storyid=6820","tags":["x_refsource_MISC"]},{"url":"http://grsecurity.net/~spender/cheddar_bay.tgz","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2009/07/17/1","name":"[oss-security] 20090717 Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html","name":"20090716 Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51803","name":"linux-kernel-tunchrpoll-code-execution(51803)","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://article.gmane.org/gmane.linux.network/124939","name":"[netdev] 20090409 Oops in tun: bisected to Limit amount of queued packets per device","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/35839","name":"35839","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512284","tags":["x_refsource_CONFIRM"]},{"url":"http://lkml.org/lkml/2009/7/6/19","name":"[linux-kernel] 20090706 Re: PROBLEM: tun/tap crashes if open() /dev/net/tun and then poll() it.","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html","name":"20090716 Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"redhat","dateUpdated":"2019-08-21T18:05:42.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749"},"datePublic":"2009-07-16T00:00:00.000Z"},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.vupen.com/english/advisories/2009/1925","name":"ADV-2009-1925","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://isc.sans.org/diary.html?storyid=6820","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://grsecurity.net/~spender/cheddar_bay.tgz","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2009/07/17/1","name":"[oss-security] 20090717 Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html","name":"20090716 Re: Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51803","name":"linux-kernel-tunchrpoll-code-execution(51803)","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://article.gmane.org/gmane.linux.network/124939","name":"[netdev] 20090409 Oops in tun: bisected to Limit amount of queued packets per device","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://secunia.com/advisories/35839","name":"35839","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512284","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lkml.org/lkml/2009/7/6/19","name":"[linux-kernel] 20090706 Re: PROBLEM: tun/tap crashes if open() /dev/net/tun and then poll() it.","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html","name":"20090716 Linux 2.6.30+/SELinux/RHEL5 test kernel 0day, exploiting the unexploitable","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-07T05:27:54.800Z"}}]}}}