Skip to content
Fencer Vulns
high 7.0

CVE-2009-3547 json

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer de…

published 2009-11-04 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-3529

cvss
7.0
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.9%
EPSS 4.9% chance of exploitation in 30 days, percentile 92%
public exploits
5
Exploit-DB

Summary

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.

Patch / fix

  • kernel RHEL 5 2.6.18-164.6.1.el5
  • kernel-PAE RHEL 5 2.6.18-164.6.1.el5
  • kernel-xen RHEL 5 2.6.18-164.6.1.el5
  • kernel-kdump RHEL 5 2.6.18-164.6.1.el5
  • kernel-debuginfo-common RHEL 5 2.6.18-164.6.1.el5
  • kernel RHEL 3 2.4.21-63.EL
  • kernel-smp RHEL 3 2.4.21-63.EL
  • kernel-BOOT RHEL 3 2.4.21-63.EL

red hat advisories RHSA-2009:1548RHSA-2009:1588RHSA-2009:1587RHSA-2009:1672RHSA-2009:1550RHSA-2009:1541

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-3547 updated cvss 7.2

kernel: fs: pipe.c null pointer dereference

  • Red Hat MRG Realtime for RHEL 5 Server kernel-rt 2.6.24.7-137.el5rt, kernel-rt-trace 2.6.24.7-137.el5rt, kernel-rt-vanilla 2.6.24.7-137.el5rt, kernel-rt-debuginfo-common 2.6.24.7-137.el5rt
    fixed: vendor fix RHSA-2009:1540
  • Red Hat Desktop version 3 kernel 2.4.21-63.EL, kernel-smp 2.4.21-63.EL, kernel-BOOT 2.4.21-63.EL, kernel-source 2.4.21-63.EL, kernel-hugemem 2.4.21-63.EL, kernel-unsupported 2.4.21-63.EL, +2 more
    fixed: vendor fix RHSA-2009:1550
  • Red Hat Enterprise Linux (v. 5 server) kernel 2.6.18-164.6.1.el5, kernel-PAE 2.6.18-164.6.1.el5, kernel-xen 2.6.18-164.6.1.el5, kernel-kdump 2.6.18-164.6.1.el5, kernel-debuginfo-common 2.6.18-164.6.1.el5
    fixed: vendor fix RHSA-2009:1548
  • Red Hat Enterprise Linux AS EUS (v. 4.7) kernel 2.6.9-78.0.28.EL, kernel-smp 2.6.9-78.0.28.EL, kernel-xenU 2.6.9-78.0.28.EL, kernel-hugemem 2.6.9-78.0.28.EL, kernel-largesmp 2.6.9-78.0.28.EL
    fixed: vendor fix RHSA-2009:1588
  • Red Hat Enterprise Linux AS version 3 kernel 2.4.21-63.EL, kernel-smp 2.4.21-63.EL, kernel-BOOT 2.4.21-63.EL, kernel-source 2.4.21-63.EL, kernel-hugemem 2.4.21-63.EL, kernel-unsupported 2.4.21-63.EL, +2 more
    fixed: vendor fix RHSA-2009:1550
  • Red Hat Enterprise Linux AS version 4 kernel 2.6.9-89.0.16.EL, kernel-smp 2.6.9-89.0.16.EL, kernel-xenU 2.6.9-89.0.16.EL, kernel-hugemem 2.6.9-89.0.16.EL, kernel-largesmp 2.6.9-89.0.16.EL
    fixed: vendor fix RHSA-2009:1541
  • Red Hat Enterprise Linux Desktop (v. 5 client) kernel 2.6.18-164.6.1.el5, kernel-PAE 2.6.18-164.6.1.el5, kernel-xen 2.6.18-164.6.1.el5, kernel-debuginfo-common 2.6.18-164.6.1.el5
    fixed: vendor fix RHSA-2009:1548
  • Red Hat Enterprise Linux Desktop version 4 kernel 2.6.9-89.0.16.EL, kernel-smp 2.6.9-89.0.16.EL, kernel-xenU 2.6.9-89.0.16.EL, kernel-hugemem 2.6.9-89.0.16.EL, kernel-largesmp 2.6.9-89.0.16.EL
    fixed: vendor fix RHSA-2009:1541
show 7 more
  • Red Hat Enterprise Linux ES EUS (v. 4.7) kernel 2.6.9-78.0.28.EL, kernel-smp 2.6.9-78.0.28.EL, kernel-xenU 2.6.9-78.0.28.EL, kernel-hugemem 2.6.9-78.0.28.EL, kernel-largesmp 2.6.9-78.0.28.EL
    fixed: vendor fix RHSA-2009:1588
  • Red Hat Enterprise Linux ES version 3 kernel 2.4.21-63.EL, kernel-smp 2.4.21-63.EL, kernel-BOOT 2.4.21-63.EL, kernel-source 2.4.21-63.EL, kernel-hugemem 2.4.21-63.EL, kernel-unsupported 2.4.21-63.EL, +2 more
    fixed: vendor fix RHSA-2009:1550
  • Red Hat Enterprise Linux ES version 4 kernel 2.6.9-89.0.16.EL, kernel-smp 2.6.9-89.0.16.EL, kernel-xenU 2.6.9-89.0.16.EL, kernel-hugemem 2.6.9-89.0.16.EL, kernel-largesmp 2.6.9-89.0.16.EL
    fixed: vendor fix RHSA-2009:1541
  • Red Hat Enterprise Linux EUS (v. 5.2 server) kernel 2.6.18-92.1.32.el5, kernel-PAE 2.6.18-92.1.32.el5, kernel-xen 2.6.18-92.1.32.el5, kernel-kdump 2.6.18-92.1.32.el5, kernel-debuginfo-common 2.6.18-92.1.32.el5
    fixed: vendor fix RHSA-2009:1672
  • Red Hat Enterprise Linux EUS (v. 5.3 server) kernel 2.6.18-128.11.1.el5, kernel-PAE 2.6.18-128.11.1.el5, kernel-xen 2.6.18-128.11.1.el5, kernel-kdump 2.6.18-128.11.1.el5, kernel-debuginfo-common 2.6.18-128.11.1.el5
    fixed: vendor fix RHSA-2009:1587
  • Red Hat Enterprise Linux WS version 3 kernel 2.4.21-63.EL, kernel-smp 2.4.21-63.EL, kernel-BOOT 2.4.21-63.EL, kernel-source 2.4.21-63.EL, kernel-hugemem 2.4.21-63.EL, kernel-unsupported 2.4.21-63.EL, +2 more
    fixed: vendor fix RHSA-2009:1550
  • Red Hat Enterprise Linux WS version 4 kernel 2.6.9-89.0.16.EL, kernel-smp 2.6.9-89.0.16.EL, kernel-xenU 2.6.9-89.0.16.EL, kernel-hugemem 2.6.9-89.0.16.EL, kernel-largesmp 2.6.9-89.0.16.EL
    fixed: vendor fix RHSA-2009:1541

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-33322)
  2. Published

Exploit prediction

4.89% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-40812 Linux Kernel 2.6.10 < 2.6.31.5 - 'pipe.c' Local Privilege Escalation local, 2013-12-16
  • EDB-33322 Linux Kernel 2.6.x - 'pipe.c' Local Privilege Escalation (2) local, 2009-11-03
  • EDB-33321 Linux Kernel 2.6.0 < 2.6.31 - 'pipe.c' Local Privilege Escalation (1) local, 2009-11-03
  • EDB-10018 Linux Kernel 2.6.32 - 'pipe.c' Local Privilege Escalation (4) local, 2009-11-12
  • EDB-9844 Linux Kernel 2.4.1 < 2.4.37 / 2.6.1 < 2.6.32-rc5 - 'pipe.c' Local Privilege Escalation (3) local, 2009-11-05
  • securityfocus.com http://www.securityfocus.com/bid/36901 referenced PoC, tagged "exploit" by a source, unverified
  • lkml.org http://lkml.org/lkml/2009/10/14/184 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
  • CWE-476 NULL Pointer Dereference
  • CWE-672 Operation on a Resource after Expiration or Release
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.