CVE-2009-3621
Summary
| CVE | CVE-2009-3621 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-10-22 16:00:00 UTC |
| Updated | 2023-02-13 02:20:00 UTC |
| Description | net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket. |
Risk And Classification
Problem Types: CWE-400
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 6.06 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 8.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 8.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 9.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 9.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 6.06 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 8.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 8.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 9.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 9.10 | All | All | All |
| Operating System | Fedoraproject | Fedora | 10 | All | All | All |
| Operating System | Fedoraproject | Fedora | 10 | All | All | All |
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Opensuse | Opensuse | 11.0 | All | All | All |
| Operating System | Opensuse | Opensuse | 11.2 | All | All | All |
| Operating System | Opensuse | Opensuse | 11.0 | All | All | All |
| Operating System | Opensuse | Opensuse | 11.2 | All | All | All |
| Operating System | Suse | Suse Linux Enterprise Desktop | 10 | sp2 | All | All |
| Operating System | Suse | Suse Linux Enterprise Desktop | 10 | sp3 | All | All |
| Operating System | Suse | Suse Linux Enterprise Desktop | 10 | sp2 | All | All |
| Operating System | Suse | Suse Linux Enterprise Desktop | 10 | sp3 | All | All |
| Operating System | Suse | Suse Linux Enterprise Server | 10 | sp2 | All | All |
| Operating System | Suse | Suse Linux Enterprise Server | 10 | sp3 | All | All |
| Operating System | Suse | Suse Linux Enterprise Server | 10 | sp2 | All | All |
| Operating System | Suse | Suse Linux Enterprise Server | 10 | sp3 | All | All |
| Operating System | Vmware | Esx | 4.0 | All | All | All |
| Operating System | Vmware | Esx | 4.0 | All | All | All |
| Application | Vmware | Vma | 4.0 | All | All | All |
| Application | Vmware | Vma | 4.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| oss-security - Re: CVE request: kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket | MLIST | www.openwall.com | Exploit, Mailing List, Patch, Third Party Advisory |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | Third Party Advisory |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | Broken Link |
| [SECURITY] Fedora 10 Update: kernel-2.6.27.38-170.2.113.fc10 | FEDORA | www.redhat.com | Mailing List, Third Party Advisory |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Repository / Oval Repository | OVAL | oval.cisecurity.org | Third Party Advisory |
| USN-864-1: Linux kernel vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | Third Party Advisory |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| LKML: Tomoki Sekiyama: Re: [PATCH] AF_UNIX: Fix deadlock on connecting to shutdown socket | MLIST | lkml.org | Mailing List, Third Party Advisory |
| Support / Security / Advisories / / MDVSA-2009:329 | Mandriva | MANDRIVA | www.mandriva.com | Broken Link |
| AF_UNIX: Fix deadlock on connecting to shutdown socket - Patchwork | CONFIRM | patchwork.kernel.org | Exploit, Mailing List, Third Party Advisory |
| Support | REDHAT | www.redhat.com | Broken Link |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| git.kernel.org | MISC | git.kernel.org | |
| SUSE update for kernel - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | Broken Link |
| SUSE update for kernel - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | Broken Link |
| git.kernel.org | CONFIRM | git.kernel.org | Broken Link |
| oss-security - CVE request: kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket | MLIST | www.openwall.com | Exploit, Mailing List, Patch, Third Party Advisory |
| Support | REDHAT | www.redhat.com | Broken Link |
| Red Hat Customer Portal | REDHAT | rhn.redhat.com | Third Party Advisory |
| VMware vMA Update for Multiple Packages - Advisories - Community | SECUNIA | secunia.com | Broken Link |
| Bug 529626 – CVE-2009-3621 kernel: AF_UNIX: Fix deadlock on connecting to shutdown socket | CONFIRM | bugzilla.redhat.com | Exploit, Issue Tracking, Third Party Advisory |
| Linux Kernel Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | SECUNIA | secunia.com | Broken Link |
| [Security-announce] VMSA-2010-0004 ESX Service Console and vMA third party updates | MLIST | lists.vmware.com | Mailing List, Third Party Advisory |
| [security-announce] SUSE Security Announcement: Linux kernel (SUSE-SA:20 | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| VMware ESX Server 4 Multiple Vulnerabilities - Advisories - Community | SECUNIA | secunia.com | Broken Link |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-12-17 | Tomas Hoger | Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2009-3621 This issue has been rated as having moderate security impact. It was addressed in Red Hat Enterprise Linux 4, 5 and Red Hat Enterprise MRG via: https://rhn.redhat.com/errata/RHSA-2009-1671.html , https://rhn.redhat.com/errata/RHSA-2009-1670.html and https://rhn.redhat.com/errata/RHSA-2009-1540.html respectively. This issue is not planned to be fixed in Red Hat Enterprise Linux 3, due to this product being in Production 3 of its maintenance life-cycle, where only qualified security errata of important or critical impact are addressed. For further information about Errata Support Policy, visit: http://www.redhat.com/security/updates/errata/ |
There are currently no legacy QID mappings associated with this CVE.