cve/cves/2009/CVE-2009-1185.md

CVE-2009-1185

Description

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.

POC

Reference

• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00012.html
• https://www.exploit-db.com/exploits/8572

Github

• https://github.com/0b0111100/2009
• https://github.com/mujtaba815/metasploitable2-privilege-escalation

ExploitDB

• https://www.exploit-db.com/exploits/21848
• https://www.exploit-db.com/exploits/8572
• https://www.exploit-db.com/exploits/8478

Metasploit

• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/udev_netlink.rb

Collections

• https://github.com/helloexp/0day/tree/master/98-Linux%E6%8F%90%E6%9D%83/2009/CVE-2009-1185