HIGH
kernel: fs: pipe.c null pointer dereference
Published Nov 4, 2009
7.0
HIGHCVSS 3.1
EPSS 4.89%
Description
Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.
Affected products
No data.
Configuration 1
OR
- ≤ 2.6.31.14
- 2.6.32
- 2.6.32
- 2.6.32
- 2.6.32
- 2.6.32
- 2.6.32
Configuration 2
OR
- 9
- 11.0
- 11.2
- 10
- 10
Configuration 3
OR
- 6.06
- 8.04
- 8.10
- 9.04
- 9.10
Configuration 4
- 10
Configuration 6
OR
- 1.0
- 3.0
- 4.0
- 5.0
- 4.8
- 5.4
- 3.0
- 4.0
- 5.0
- 3.0
- 4.0
- 5.0
No data.
MRG for RHEL-5
kernel-rt-0:2.6.24.7-137.el5rt
Fixed · RHSA-2009:1540
Red Hat Enterprise Linux 3
kernel-0:2.4.21-63.EL
Fixed · RHSA-2009:1550
Red Hat Enterprise Linux 4
kernel-0:2.6.9-89.0.16.EL
Fixed · RHSA-2009:1541
Red Hat Enterprise Linux 4.7 Z Stream
kernel-0:2.6.9-78.0.28.EL
Fixed · RHSA-2009:1588
Red Hat Enterprise Linux 5
kernel-0:2.6.18-164.6.1.el5
Fixed · RHSA-2009:1548
Red Hat Enterprise Linux 5.2 Z Stream
kernel-0:2.6.18-92.1.32.el5
Fixed · RHSA-2009:1672
Red Hat Enterprise Linux 5.3.Z - Server Only
kernel-0:2.6.18-128.11.1.el5
Fixed · RHSA-2009:1587
| Product | Package | State | Advisory |
|---|---|---|---|
| MRG for RHEL-5 | kernel-rt-0:2.6.24.7-137.el5rt | Fixed | RHSA-2009:1540 |
| Red Hat Enterprise Linux 3 | kernel-0:2.4.21-63.EL | Fixed | RHSA-2009:1550 |
| Red Hat Enterprise Linux 4 | kernel-0:2.6.9-89.0.16.EL | Fixed | RHSA-2009:1541 |
| Red Hat Enterprise Linux 4.7 Z Stream | kernel-0:2.6.9-78.0.28.EL | Fixed | RHSA-2009:1588 |
| Red Hat Enterprise Linux 5 | kernel-0:2.6.18-164.6.1.el5 | Fixed | RHSA-2009:1548 |
| Red Hat Enterprise Linux 5.2 Z Stream | kernel-0:2.6.18-92.1.32.el5 | Fixed | RHSA-2009:1672 |
| Red Hat Enterprise Linux 5.3.Z - Server Only | kernel-0:2.6.18-128.11.1.el5 | Fixed | RHSA-2009:1587 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
7.0 HIGH NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
No CVSS v3.0 score for this CVE.
6.9 MEDIUM NVD
AV:L/AC:M/Au:N/C:C/I:C/A:C
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact Complete
Integrity Impact Complete
Availability Impact Complete
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
4.89% 0.04890
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.
EPSS probability 0.04890
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (19 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 2, 2026 | 4.89% (0.04890) | 91.81th | v5 (v2026.06.15) |
| Jun 15, 2026 | 4.93% (0.04930) | 90.98th | v5 (v2026.06.15) |
| Jun 8, 2026 | 2.01% (0.02012) | 84.05th | v4 (v2025.03.14) |
| Feb 20, 2026 | 3.26% (0.03265) | 86.88th | v4 (v2025.03.14) |
| Feb 12, 2026 | 6.08% (0.06077) | 90.55th | v4 (v2025.03.14) |
| Dec 12, 2025 | 2.41% (0.02412) | 84.63th | v4 (v2025.03.14) |
| Sep 19, 2025 | 3.44% (0.03441) | 87.05th | v4 (v2025.03.14) |
| Sep 18, 2025 | 6.89% (0.06893) | 91.02th | v4 (v2025.03.14) |
| May 25, 2025 | 4.74% (0.04740) | 88.86th | v4 (v2025.03.14) |
| Mar 25, 2025 | 3.73% (0.03733) | 86.84th | v4 (v2025.03.14) |
| Mar 17, 2025 | 5.13% (0.05128) | 89.11th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.04% (0.00042) | 5.11th | v3 (v2023.03.01) |
| Nov 4, 2023 | 0.04% (0.00042) | 5.76th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.04% (0.00042) | 0.50th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.22% (0.03220) | 84.21th | v2 (v2022.01.01) |
| Feb 13, 2023 | 3.22% (0.03220) | 83.79th | v2 (v2022.01.01) |
| Feb 3, 2023 | 5.79% (0.05787) | 90.14th | v2 (v2022.01.01) |
| Apr 1, 2022 | 3.22% (0.03220) | 82.61th | v2 (v2022.01.01) |
| Feb 4, 2022 | 3.22% (0.03220) | 65.30th | v2 (v2022.01.01) |
References (32)
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ad3960243e55320d74195fb85c975e0a8cc4466c x_refsource_CONFIRMBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html vendor-advisoryx_refsource_SUSEMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html vendor-advisoryx_refsource_SUSEBroken LinkMailing ListThird Party Advisory
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://lkml.org/lkml/2009/10/14/184 mailing-listx_refsource_MLISTExploitMailing List
- http://lkml.org/lkml/2009/10/21/42 mailing-listx_refsource_MLISTMailing ListPatch
- http://marc.info/?l=oss-security&m=125724568017045&w=2 mailing-listx_refsource_MLISTMailing ListThird Party Advisory
- http://secunia.com/advisories/37351 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/38017 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/38794 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/38834 third-party-advisoryx_refsource_SECUNIABroken Link
- http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc6 x_refsource_CONFIRMBroken Link
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:329 vendor-advisoryx_refsource_MANDRIVABroken Link
- http://www.redhat.com/support/errata/RHSA-2009-1672.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.securityfocus.com/archive/1/512019/100/0/threaded mailing-listx_refsource_BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/36901 vdb-entryx_refsource_BIDBroken LinkExploitThird Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/usn-864-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- http://www.vupen.com/english/advisories/2010/0528 vdb-entryx_refsource_VUPENBroken Link
- https://access.redhat.com/security/cve/CVE-2009-3547 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=530490 x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2009-3547
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11513 vdb-entrysignaturex_refsource_OVALBroken LinkThird Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7608 vdb-entrysignaturex_refsource_OVALBroken LinkThird Party Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9327 vdb-entrysignaturex_refsource_OVALBroken LinkThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1540.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1541.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1548.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2009-1550.html vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2009-3547
- https://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.html vendor-advisoryx_refsource_FEDORAMailing List
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Nov 4, 2009
Updated Aug 7, 2024
Reserved Oct 5, 2009
Link CVE-2009-3547
CISA Vulnrichment
Updated n/a