Quantum Secular Labs / Blog / Advisories

CVE-2009-4538: drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly…

CVE-2009-4538 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Linux Kernel, along with 1 other product in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Linux Kernel: up to and including 2.6.32.3
  • Debian Linux: 4.0; 5.0

References