CVE-2009-1046

Status: ModifiedMedium (4.7)—Exploit

Severity4.7Medium · CVSS 2.0

Exploitation probability0.78 %higher than 55% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an "off-by-two memory error." NOTE: it is not clear whether this issue crosses privilege boundaries.

CVSS

Base score: 4.7
Version: 2.0
Vector: AV:L/AC:M/Au:N/C:N/I:N/A:C

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.78 %
Percentile among all scored CVEs: 55
Score date: 10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · Linux Kernel 2.6.24_16-23/2.6.27_7-10/2.6.28.3 (Ubuntu 8.04/8.10 / Fedora Core 10 x86-64) - 'set_selection()' UTF-8 Off-by-One Privilege Escalation (7/9/2009)

Affected technologies (1)

Linux — Linux Kernel

CWEs

CWE-399

References

Show 28 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2009-1046",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.7,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-03-23T16:30:01.577",
  "references": [
    {
      "url": "http://lists.openwall.net/linux-kernel/2009/01/30/333",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.openwall.net/linux-kernel/2009/02/02/364",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/34917",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/34981",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35121",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1787",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1800",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.4",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/02/12/10",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/02/12/11",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/02/12/9",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0451.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/33672",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-751-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lists.openwall.net/linux-kernel/2009/01/30/333",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.openwall.net/linux-kernel/2009/02/02/364",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/34917",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/34981",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35121",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1787",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2009/dsa-1800",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28.4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/02/12/10",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/02/12/11",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/02/12/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.redhat.com/support/errata/RHSA-2009-0451.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/33672",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/usn-751-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The console selection feature in the Linux kernel 2.6.28 before 2.6.28.4, 2.6.25, and possibly earlier versions, when the UTF-8 console is used, allows physically proximate attackers to cause a denial of service (memory corruption) by selecting a small number of 3-byte UTF-8 characters, which triggers an \"off-by-two memory error.\" NOTE: it is not clear whether this issue crosses privilege boundaries."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de selección de consola en el kernel de Linux 2.6.28 en versiones anteriores a 2.6.28.4, 2.6.25 y posiblemente versiones anteriores, cuando se utiliza la consola UTF-8, permite a atacantes físicamente próximos causar una denegación de servicio (corrupción de memoria) seleccionando un número pequeño de carácteres de 3 bytes UTF-8, lo que desencadena un \"error de memoria off-by-two\". NOTA: no queda claro si el problema traspasa límites de privilegio."
    }
  ],
  "lastModified": "2026-06-16T23:06:23.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71295664-89EC-4BB3-9F86-B1DDA20FAC5A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.28:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26BD805F-08EB-42EC-BC54-26A7278E5089"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.28.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "217715A5-E69D-45C0-B8E4-5681528C651B"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.28.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A87AD66C-4321-4459-8556-3B0BA38C493A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.28.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "87A347E0-9C0B-4674-9363-3C36DA27AC45"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and 5.\n\nIt was addressed in Red Hat Enterprise MRG via: https://rhn.redhat.com/errata/RHSA-2009-0451.html .",
      "lastModified": "2009-05-19T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}