CVE-2009-1265
Summary
| CVE | CVE-2009-1265 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-04-08 01:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux kernel 2.6.24.4, and other versions before 2.6.30-rc1, might allow remote attackers to obtain sensitive information via a large length value, which causes "garbage" memory to be sent. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | 2.6.24.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.24.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.10 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.11 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.12 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.13 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.14 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.15 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.16 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.17 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.18 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.19 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.20 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.8 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.25.9 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.26.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.10 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.11 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.12 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.13 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.14 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.15 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.16 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.17 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.18 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.19 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.20 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.21 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.22 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.23 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.24 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.25 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.26 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.27 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.28 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.29 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.30 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.31 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.32 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.33 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.34 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.35 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.36 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.37 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.38 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.39 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.40 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.41 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.42 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.43 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.44 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.45 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.46 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.47 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.48 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.49 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.50 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.51 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.52 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.53 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.54 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.55 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.56 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.57 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.58 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.59 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.60 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.61 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.62 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.8 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.27.9 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.10 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.6 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.7 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.8 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.28.9 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.29 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.29.1 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.29.2 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.29.3 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.29.4 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.29.5 | All | All | All |
| Operating System | Linux | Linux Kernel | 2.6.29.6 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Ubuntu update for linux and linux-source-2.6.15 - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Debian update for linux-2.6.24 - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Debian -- Security Information -- DSA-1787-1 linux-2.6.24 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| USN-793-1: Linux kernel vulnerabilities | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Linux Kernel Frame Size Integer Overflow Remote Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| 10423 – (Patch queued)af_rose sendmsg length check | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.kernel.org | Exploit |
| SUSE update for kernel - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| osvdb.org/53631 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| osvdb.org/53630 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Security Advisory SA35390 - SUSE update for kernel - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| osvdb.org/53571 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Support / Security / Advisories / / MDVSA-2009:119 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Debian update for linux-2.6 - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Support / Security / Advisories / / MDVSA-2009:135 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Debian -- Security Information -- DSA-1800-1 linux-2.6 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| SUSE update for kernel - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| oss-security - CVE-2009-1265 kernel: af_rose/x25: Sanity check the maximum user frame size | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| SUSE update for kernel - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Debian update for linux-2.6 - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| kernel/git/torvalds/linux.git - Linux kernel source tree | af854a3a-2127-422b-91ae-364da2661108 | git.kernel.org | |
| Debian -- Security Information -- DSA-1794-1 linux-2.6 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| kernel/git/torvalds/linux.git - Linux kernel source tree | MITRE | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-06-17 | Tomas Hoger | This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 4, 5, or Red Hat Enterprise MRG, as the affected driver is not enabled in these kernels. The affected driver is available in Red Hat Enterprise Linux 3, but only if the kernel-unsupported package is installed. This issue has been rated as having moderate security impact as it does not lead to a denial of service or privilege escalation. As Red Hat Enterprise Linux 3 is now in Production 3 of its maintenance life-cycle, http://www.redhat.com/security/updates/errata, and the affected driver can only be enabled when using the unsupported kernel-unsupported package, a fix for this issue is not currently planned to be included in the future updates. |
There are currently no legacy QID mappings associated with this CVE.