udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.8927.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Canonical
  • Ubuntu Linux
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Juniper
  • Ctpview
Opensuse
  • Opensuse
Redhat
  • Enterprise Linux
Suse
  • Linux Enterprise Debuginfo
  • Linux Enterprise Desktop
  • Linux Enterprise Server
Udev Project
  • Udev

Configuration 1 [-]

cpe:2.3:a:udev_project:udev:*:*:*:*:*:*:*:*

Configuration 2 [-]

OR cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp2:*:*:*:*:*:*
cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

Configuration 4 [-]

OR cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

Configuration 5 [-]

OR cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*

Configuration 6 [-]

OR cpe:2.3:a:juniper:ctpview:*:*:*:*:*:*:*:*
cpe:2.3:a:juniper:ctpview:7.1:-:*:*:*:*:*:*
cpe:2.3:a:juniper:ctpview:7.1:r1:*:*:*:*:*:*
cpe:2.3:a:juniper:ctpview:7.2:-:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 5
udev-0:095-14.20.el5_3 cpe:/o:redhat:enterprise_linux:5 RHSA-2009:0427 2009-04-16T00:00:00Z

No data.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-1772-1 New udev packages fix privilege escalation
Ubuntu USN Ubuntu USN USN-758-1 udev vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e2b362d9f23d4c63018709ab5f81a02f72b91e75 cve-icon cve-icon
http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e86a923d508c2aed371cdd958ce82489cf2ab615 cve-icon cve-icon
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691 cve-icon cve-icon
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00006.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00012.html cve-icon cve-icon
http://lists.vmware.com/pipermail/security-announce/2009/000060.html cve-icon cve-icon
http://secunia.com/advisories/34731 cve-icon cve-icon
http://secunia.com/advisories/34750 cve-icon cve-icon
http://secunia.com/advisories/34753 cve-icon cve-icon
http://secunia.com/advisories/34771 cve-icon cve-icon
http://secunia.com/advisories/34776 cve-icon cve-icon
http://secunia.com/advisories/34785 cve-icon cve-icon
http://secunia.com/advisories/34787 cve-icon cve-icon
http://secunia.com/advisories/34801 cve-icon cve-icon
http://secunia.com/advisories/35766 cve-icon cve-icon
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.446399 cve-icon cve-icon
http://wiki.rpath.com/Advisories:rPSA-2009-0063 cve-icon cve-icon
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063 cve-icon cve-icon
http://www.debian.org/security/2009/dsa-1772 cve-icon cve-icon
http://www.gentoo.org/security/en/glsa/glsa-200904-18.xml cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2009:103 cve-icon cve-icon
http://www.mandriva.com/security/advisories?name=MDVSA-2009:104 cve-icon cve-icon
http://www.redhat.com/support/errata/RHSA-2009-0427.html cve-icon cve-icon
http://www.securityfocus.com/archive/1/502752/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/archive/1/504849/100/0/threaded cve-icon cve-icon
http://www.securityfocus.com/bid/34536 cve-icon cve-icon
http://www.securitytracker.com/id?1022067 cve-icon cve-icon
http://www.ubuntu.com/usn/usn-758-1 cve-icon cve-icon
http://www.vmware.com/security/advisories/VMSA-2009-0009.html cve-icon cve-icon
http://www.vupen.com/english/advisories/2009/1053 cve-icon cve-icon
http://www.vupen.com/english/advisories/2009/1865 cve-icon cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=495051 cve-icon cve-icon
https://launchpad.net/bugs/cve/2009-1185 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2009-1185 cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10925 cve-icon cve-icon
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5975 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2009-1185 cve-icon
https://www.exploit-db.com/exploits/8572 cve-icon cve-icon
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00462.html cve-icon cve-icon
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00463.html cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-07T05:04:49.238Z

Reserved: 2009-03-31T00:00:00

Link: CVE-2009-1185

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2009-04-17T14:30:00.563

Modified: 2025-04-09T00:30:58.490

Link: CVE-2009-1185

cve-icon Redhat

Severity : Important

Publid Date: 2009-04-15T00:00:00Z

Links: CVE-2009-1185 - Bugzilla

cve-icon OpenCVE Enrichment

No data.