CVE-2009-1961 Denial of service in n/a

What is CVE-2009-1961?

CVE-2009-1961 is a medium-severity denial of service vulnerability in Canonical Ubuntu Linux, published on 6 Jun 2009. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.

Weakness: CWE-667

Which versions are affected by CVE-2009-1961?

It affects 7 products.

Products include Canonical Ubuntu Linux, Debian Debian Linux, Linux kernel, Opensuse Opensuse, Suse Linux Enterprise, Suse Linux Enterprise Desktop and 1 more.

How do I fix CVE-2009-1961?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2009-1961 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2009-1961 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Canonical Ubuntu Linux

• CVE-2020-11651 SaltStack Salt Authentication Bypass Exploited Critical 9.8
• CVE-2020-7247 OpenSMTPD Remote Code Execution Exploited Critical 9.8
• CVE-2019-16928 Exim Out-of-bounds Write Exploited Critical 9.8
• CVE-2018-6789 Exim Buffer Overflow Exploited Critical 9.8
• CVE-2015-2590 Oracle Java SE and Java SE Embedded Remote Code Execution Exploited Critical 9.8

All Canonical Ubuntu Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-53cw-7857-2j7g.