{"id":"CVE-2009-1897","aliases":["EUVD-2009-1892","GHSA-7g2j-wp9p-8rcr"],"status":"published","title":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30...","description":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.","severity":{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01521,"percentile":0.7477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119"],"published":"2009-07-20T17:00:00Z","modified":"2026-06-16T23:08:18Z","exploits":[{"source":"exploitdb","id":"EDB-33088","title":"Linux Kernel 2.6.30 - 'tun_chr_pool()' Null Pointer Dereference","type":"dos","platform":"linux","date":"2009-06-17","verified":true,"url":"https://www.exploit-db.com/exploits/33088"},{"source":"exploitdb","id":"EDB-9191","title":"Linux Kernel 2.6.30 \u003c 2.6.30.1 / SELinux (RHEL 5) - Local Privilege Escalation","type":"local","platform":"linux","date":"2009-07-17","verified":true,"url":"https://www.exploit-db.com/exploits/9191"}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.vupen.com/english/advisories/2009/1925","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Patch","Vendor Advisory"]},{"url":"http://isc.sans.org/diary.html?storyid=6820","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://grsecurity.net/~spender/cheddar_bay.tgz","tags":["x_refsource_MISC","x_transferred","Patch"]},{"url":"http://www.openwall.com/lists/oss-security/2009/07/17/1","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/51803","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://article.gmane.org/gmane.linux.network/124939","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://secunia.com/advisories/35839","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=512284","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://lkml.org/lkml/2009/7/6/19","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit"]},{"url":"http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"]},{"url":"https://www.redhat.com/en/blog/security-flaws-caused-compiler-optimizations","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1897"},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3c8a9c63d5fd738c261bd0ceece04d9c8357ca13"},{"url":"https://github.com/advisories/GHSA-7g2j-wp9p-8rcr"}],"sources":{"cve":[{"id":"CVE-2009-1897","description":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.","status":"published","published":"2009-07-20T17:00:00Z","modified":"2024-08-07T05:27:54.8Z","updated_at":"2026-11-02T14:33:25.126493Z"}],"euvd":[{"id":"EUVD-2009-1892","description":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.","status":"published","published":"2009-07-20T17:00:00Z","modified":"2024-08-07T05:27:54Z","updated_at":"2026-11-03T01:39:19.949759Z"}],"ghsa":[{"id":"GHSA-7g2j-wp9p-8rcr","title":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30...","description":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.","status":"published","published":"2022-05-02T03:29:42Z","modified":"2023-02-20T05:05:40Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:10.77374Z"}],"nvd":[{"id":"CVE-2009-1897","description":"The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.","status":"published","published":"2009-07-20T17:30:54.733Z","modified":"2026-06-16T23:08:18.753Z","cvss":[{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:01:36.200173Z"}]}}