{"uuid": "1fcdd7f7-bf59-49f2-bf06-c34d7245b272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2009-2692", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/sock_sendpage.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"x86\", \"author\": [\"Tavis Ormandy\", \"Julien Tinnes \", \"spender\", \"rcvalle\", \"egypt \"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"The Linux kernel failed to properly initialize some entries in the\\n          proto_ops struct for several protocols, leading to NULL being\\n          dereferenced and used as a function pointer. By using mmap(2) to map\\n          page 0, an attacker can execute arbitrary code in the context of the\\n          kernel.\\n\\n          Several public exploits exist for this vulnerability, including\\n          spender's wunderbar_emporium and rcvalle's ppc port, sock_sendpage.c.\\n\\n          All Linux 2.4/2.6 versions since May 2001 are believed to be affected:\\n          2.4.4 up to and including 2.4.37.4; 2.6.0 up to and including 2.6.30.4\\n\\n          This module has been tested successfully on CentOS 5.0 (i386) with\\n          kernel version 2.6.18-8.1.1.tl5; and Debian 3.1r8 Sarge (i686) with\\n          kernel version 2.4.27-3-386.\", \"disclosure_date\": \"2009-08-13\", \"fullname\": \"exploit/linux/local/sock_sendpage\", \"is_install_path\": true, \"mod_time\": \"2026-05-14 11:43:36 +0000\", \"name\": \"Linux Kernel Sendpage Local Privilege Escalation\", \"needs_cleanup\": true, \"notes\": {\"AKA\": [\"EXACTCHANGE\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [], \"Stability\": [\"crash-os-down\"]}, \"path\": \"/modules/exploits/linux/local/sock_sendpage.rb\", \"platform\": \"Linux\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"linux/local/sock_sendpage\", \"references\": [\"CVE-2009-2692\", \"EDB-9545\", \"EDB-9641\", \"BID-36038\", \"URL-https://www.securityfocus.com/archive/1/505751\", \"URL-http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html\"], \"rport\": null, \"session_types\": [\"shell\", \"meterpreter\"], \"targets\": [\"Linux x86\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:12.240769Z"}