Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-1897. PoCs published by spender, Christian Borntraeger.
AI-analyzed exploit summary This exploit leverages a null pointer dereference vulnerability in the Linux kernel's /dev/net/tun driver, exacerbated by GCC optimizations and SELinux mmap_min_addr bypass, to achieve local privilege escalation. It demonstrates arbitrary code execution by ORing a file_op structure to disable security mechanisms like SELinux, AppArmor, and LSM.
Description
The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.
Exploits (2)
This exploit leverages a null pointer dereference vulnerability in the Linux kernel's /dev/net/tun driver, exacerbated by GCC optimizations and SELinux mmap_min_addr bypass, to achieve local privilege escalation. It demonstrates arbitrary code execution by ORing a file_op structure to disable security mechanisms like SELinux, AppArmor, and LSM.
The provided text describes a local NULL-pointer dereference vulnerability in the Linux kernel (CVE-2009-1897), introduced in version 2.6.30, which can lead to privilege escalation or denial of service. However, the actual exploit code is not included in the snippet; only references to external binaries are provided.