NULL pointer dereference in Linux Kernel
CVE-2009-4895
Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux kernel before 2.6.32.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via unknown vectors, related to the put_tty_queue and __f_setown functions. NOTE: the vulnerability was addressed in a different way in 2.6.32.9.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.003 (16.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 16th percentile — 16.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Linux Kernel
- Canonical Ubuntu Linux — versions 10.10, 6.06, 10.04
- Debian Linux — versions 5.0
Weakness classification (CWE)
References
- www.openwall.com/lists/oss-security/2010/06/15/5 (mailing-list, Mailing List, Third Party Advisory)
- www.ubuntu.com/usn/USN-1000-1 (vendor-advisory, Third Party Advisory)
- bugzilla.kernel.org/show_bug.cgi (Patch, Issue Tracking)
- www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.6 (Broken Link)
- www.openwall.com/lists/oss-security/2010/06/15/2 (mailing-list, Patch, Mailing List, Third Party Advisory)
- www.openwall.com/lists/oss-security/2010/06/15/3 (mailing-list, Mailing List, Third Party Advisory)
- www.openwall.com/lists/oss-security/2010/06/15/4 (mailing-list, Mailing List, Third Party Advisory)
- git.kernel.org/ (Broken Link)
- bugzilla.redhat.com/show_bug.cgi (Third Party Advisory, Issue Tracking)
- www.debian.org/security/2010/dsa-2094 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2009-4895?
- CVE-2009-4895 is a medium-severity vulnerability in Linux Kernel, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 4.7/10. Published 2010-09-08.
- How severe is CVE-2009-4895?
- Medium severity. CVSS v3 base score is 4.7 out of 10.