CVE-2009-2903
HighMemory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
CVSS 2.0 score
7.1
AV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness type
CWE-772CVE-2009-2903 is a Missing Release of Resource after Effective Lifetime vulnerability
What is Missing Release of Resource after Effective Lifetime?
The product does not release a resource after its effective lifetime has ended. Learn more on MITRE CWE
References
The following references provide additional information about CVE-2009-2903 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Third Party Advisory
-
Third Party Advisory
-
Third Party Advisory
-
Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Mailing List Third Party Advisory
-
Securityfocushttp://www.securityfocus.com/bid/36379Third Party Advisory VDB Entry
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-852-1Third Party Advisory
-
Issue Tracking Third Party Advisory
-
PatchKernel patch commithttp://git.kernel.org/?p=linux/kernel/git/davem/net-next-2.6.git%3Ba=commit%3Bh=ffcfb8db540ff879c2a85bf7e404954281443414
Frequently asked questions
-
What is CVE-2009-2903?
CVE-2009-2903 is a High severity Linux kernel vulnerability with a CVSS score of 7.1 out of 10 , classified as a Missing Release of Resource after Effective Lifetime flaw (CWE-772) . CVE-2009-2903 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2009-2903?
CVE-2009-2903 has a CVSS score of 7.1 out of 10, rated High severity (CVSS 2.0). The vector string is
AV:N/AC:M/Au:N/C:N/I:N/A:C. -
Is there a patch available for CVE-2009-2903?
No patch is currently available for CVE-2009-2903. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2009-2903 actively exploited?
No — CVE-2009-2903 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
-
What is Missing Release of Resource after Effective Lifetime (CWE-772)?
The product does not release a resource after its effective lifetime has ended. View CWE-772 on MITRE CWE →