CVE-2009-2692

HighPublished

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops...

Published: Aug 14, 2009
Updated: Aug 7, 2024
Assigning CNA: mitre
Evidence observed: Aug 14, 2009

Primary CVSS

7.8/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

14.6%

Moderate · next 30 days

Percentile: 96.6%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.

Sources

Repository evidence: Files: 1 · Repositories: 1

1 Module

Linux Kernel Sendpage Local Privilege EscalationModule
modules/exploits/linux/local/sock_sendpage.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- platform: Linux($.exploit_linux/local/sock_sendpage.platform)
- verification: check_declared($.exploit_linux/local/sock_sendpage.check)

CVE-2009-2692Exploit
Compiled binary of CVE-2009-2692 Linux null pointer dereference exploit for educational demonstration of kernel privilege escalation.
2009PoC
Collection of Linux kernel exploits targeting CVE-2009-1185, CVE-2009-1337, CVE-2009-2692, CVE-2009-2698, and CVE-2009-3547, providing proof-of-concept code for privilege escalation.
LinuxEelvationExploit
Linux Eelvation(持续更新)
linux-kernel-exploitsExploit
linux-kernel-exploits Linux平台提权漏洞集合
Linux Kernel 2.x (RedHat) - 'sock_sendpage()' Ring0 Privilege Escalation (1)Exploit
spender · linux · Aug 14, 2009
Linux Kernel 2.x - 'sock_sendpage()' Local Privilege Escalation (4)Exploit
Przemyslaw Frasunek · linux · Aug 14, 2009
Linux Kernel 2.x (Android) - 'sock_sendpage()' Local Privilege EscalationExploit
Zinx · android · Aug 18, 2009
Linux Kernel 2.4/2.6 (RedHat Linux 9 / Fedora Core 4 < 11 / Whitebox 4 / CentOS 4) - 'sock_sendpage()' Ring0 Privilege Escalation (5)Exploit
INetCop Security · linux · Aug 24, 2009
Linux Kernel 2.4.x/2.6.x (CentOS 4.8/5.3 / RHEL 4.8/5.3 / SuSE 10 SP2/11 / Ubuntu 8.10) (PPC) - 'sock_sendpage()' Local Privilege EscalationExploit
Ramon de C Valle · linux · Aug 31, 2009
Linux Kernel 2.4/2.6 (Fedora 11) - 'sock_sendpage()' Local Privilege Escalation (2)Exploit
Ramon de C Valle · linux · Sep 9, 2009
Linux Kernel 2.4/2.6 - 'sock_sendpage()' Local Privilege Escalation (3)Exploit
Ramon de C Valle · linux · Sep 11, 2009
Linux Kernel 2.4.4 < 2.4.37.4 / 2.6.0 < 2.6.30.4 - 'Sendpage' Local Privilege Escalation (Metasploit)Exploit
Metasploit · linux · Jul 19, 2012

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.