CVE-2009-1046
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly...
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
Exploit likelihood
What each source reports
NVD Score used
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
- Record
CVE-2009-1046- CVSS 2.0
- 4.7 Medium
AV:L/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
- Record
CVE-2009-1046- Updated
- 2026-11-02
EUVDEUVD-2009-1047 No score
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
- Record
EUVD-2009-1047- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76f5-x782-3pq8 No score
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly...
The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.
- Record
GHSA-76f5-x782-3pq8- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linux-2.6.24Debian:4.0 From an advisory covering 24 CVEs |
before 2.6.24-6~etchnhalf.8etch1, plus listed versions 2.6.24-5~etchnhalf.12.6.24-6~etchnhalf.12.6.24-6~etchnhalf.22.6.24-6~etchnhalf.32.6.24-6~etchnhalf.4 Show 4 moreShow less2.6.24-6~etchnhalf.52.6.24-6~etchnhalf.62.6.24-6~etchnhalf.72.6.24-6~etchnhalf.8 |
2.6.24-6~etchnhalf.8etch1 |
linux-2.6Debian:5.0 From an advisory covering 13 CVEs |
before 2.6.26-15lenny2, plus listed versions 2.6.26-132.6.26-13lenny22.6.26-13lenny2~bpo40+12.6.26-142.6.26-152.6.26-15lenny12.6.26-15~bpo40+12.6.26-15~bpo40+2 |
2.6.26-15lenny2 |
user-mode-linuxDebian:5.0 From an advisory covering 13 CVEs |
before 2.6.26-1um-2+15lenny2, plus listed versions 2.6.26-1um-22.6.26-1um-2+15 |
2.6.26-1um-2+15lenny2 |
kernel-rtRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debugRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debug-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debug-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-debuginfo-commonRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-rt-docRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-traceRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-trace-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-trace-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-vanillaRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-vanilla-debuginfoRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
kernel-rt-vanilla-develRed Hat:enterprise_mrg:1::el5 From an advisory covering 6 CVEs |
before 0:2.6.24.7-111.el5rt | 0:2.6.24.7-111.el5rt |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Linux Kernel 2.6.24_16-23/2.6.27_7-10/2.6.28.3 (Ubuntu 8.04/8.10 / Fedora Core 10 x86-64) - 'set_selection()' UTF-8 Off-by-One Privilege Escalation | 2009-07-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1046 is a medium vulnerability (CVSS 4.7) in Linux Kernel, published March 23, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. No source names a fixed version.
References
kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.4
openwall.com/lists/oss-security/2009/02/12/9
securityfocus.com/bid/33672
ubuntu.com/usn/usn-751-1
lists.openwall.net/linux-kernel/2009/02/02/364
Show 36 moreShow less
secunia.com/advisories/34981
debian.org/security/2009/dsa-1800
redhat.com/support/errata/RHSA-2009-0451.html
nvd.nist.gov/vuln/detail/CVE-2009-1046
github.com/advisories/GHSA-76f5-x782-3pq8
access.redhat.com/errata/RHSA-2009:0451
bugzilla.redhat.com/show_bug.cgi?id=456282
security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_0451.json
cve.org/CVERecord?id=CVE-2008-4307