CVE-2009-1360 in Linux
Summary
by MITRE
The __inet6_check_established function in net/ipv6/inet6_hashtables.c in the Linux kernel before 2.6.29, when Network Namespace Support (aka NET_NS) is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via vectors involving IPv6 packets.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/06/2019
The vulnerability identified as CVE-2009-1360 represents a critical NULL pointer dereference flaw within the Linux kernel's IPv6 networking stack. This issue specifically affects systems running kernel versions prior to 2.6.29 and becomes exploitable when Network Namespace Support is enabled. The vulnerability resides in the __inet6_check_established function located in net/ipv6/inet6_hashtables.c, which handles the establishment of IPv6 connections within the kernel's networking subsystem. The flaw manifests when processing certain IPv6 packets that trigger improper handling of connection state information, leading to a system crash through a NULL pointer dereference.
The technical execution of this vulnerability requires an attacker to send specifically crafted IPv6 packets to a target system that has NET_NS support enabled. When the kernel processes these packets through the vulnerable __inet6_check_established function, it fails to properly validate certain connection parameters before attempting to dereference pointers that may be NULL. This failure occurs in the context of IPv6 packet handling within network namespaces, which are isolated network stack environments that can be created for different processes or applications. The vulnerability is particularly concerning because it can be exploited remotely without requiring authentication or special privileges, making it a significant threat to network availability.
The operational impact of CVE-2009-1360 extends beyond simple denial of service to potentially compromise entire system stability and availability. When exploited successfully, the vulnerability causes immediate system crashes that result in complete service disruption for all network-dependent applications running on the affected system. This type of vulnerability is classified under CWE-476 as a NULL Pointer Dereference, which is a well-known weakness that occurs when a program attempts to access a memory location through a pointer that has not been properly initialized to a valid address. The ATT&CK framework categorizes this as a system crash or reboot technique, which can be used as a denial of service vector against targeted systems. The vulnerability affects systems where network namespaces are actively used, which includes many modern server environments and containerized deployments.
Mitigation strategies for CVE-2009-1360 primarily involve upgrading to kernel versions 2.6.29 or later where the vulnerability has been patched. System administrators should prioritize this update across all affected systems, particularly those running services that are exposed to external network traffic or those that utilize network namespaces. Additionally, organizations can implement network-level protections such as firewall rules that filter suspicious IPv6 traffic patterns, though these measures are not foolproof and should not replace proper system patching. The patch for this vulnerability specifically addresses the improper pointer validation within the __inet6_check_established function, ensuring that all connection state parameters are properly validated before any pointer dereference operations occur. Organizations should also consider implementing intrusion detection systems that monitor for unusual IPv6 packet patterns that might indicate exploitation attempts, as the vulnerability can be leveraged in automated attack scenarios against vulnerable systems.