CVE-2009-1185
CVE-2009-1185 is a high-severity vulnerability in Udev Project Udev with a CVSS 2.0 base score of 7.2. Its EPSS exploit-prediction score of 82% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-346.
Key facts
- Severity: High (CVSS 2.0 base score 7.2)
- EPSS exploit prediction: 82% (100th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-346
- Affected product: Udev Project Udev
- Published:
- Last modified:
Description
udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
Frequently asked questions
- What is CVE-2009-1185?
- udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, which allows local users to gain privileges by sending a NETLINK message from user space.
- How severe is CVE-2009-1185?
- CVE-2009-1185 has a CVSS 2.0 base score of 7.2, rated high severity.
- Is CVE-2009-1185 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 82% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-1185?
- CVE-2009-1185 primarily affects Udev Project Udev. In total, 22 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-1185?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2009-1185 published?
- CVE-2009-1185 was published on 2009-04-17 and last updated on 2026-06-16.
References
- http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e2b362d9f23d4c63018709ab5f81a02f72b91e75
- http://git.kernel.org/?p=linux/hotplug/udev.git%3Ba=commitdiff%3Bh=e86a923d508c2aed371cdd958ce82489cf2ab615
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00012.html
- http://lists.vmware.com/pipermail/security-announce/2009/000060.html
- http://secunia.com/advisories/34731
- http://secunia.com/advisories/34750
- http://secunia.com/advisories/34753
- http://secunia.com/advisories/34771
- http://secunia.com/advisories/34776
- http://secunia.com/advisories/34785
- http://secunia.com/advisories/34787
- http://secunia.com/advisories/34801
- http://secunia.com/advisories/35766
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.446399
- http://wiki.rpath.com/Advisories:rPSA-2009-0063
- http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0063
- http://www.debian.org/security/2009/dsa-1772
- http://www.gentoo.org/security/en/glsa/glsa-200904-18.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:103
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:104
- http://www.redhat.com/support/errata/RHSA-2009-0427.html
- http://www.securityfocus.com/archive/1/502752/100/0/threaded
- http://www.securityfocus.com/archive/1/504849/100/0/threaded
- http://www.securityfocus.com/bid/34536
- http://www.securitytracker.com/id?1022067
- http://www.ubuntu.com/usn/usn-758-1
- http://www.vmware.com/security/advisories/VMSA-2009-0009.html
Affected products (22)
- cpe:2.3:a:udev_project:udev:*:*:*:*:*:*:*:*
- cpe:2.3:a:suse:linux_enterprise_debuginfo:10:sp2:*:*:*:*:*:*
- cpe:2.3:a:suse:linux_enterprise_debuginfo:11:-:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:-:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
- cpe:2.3:a:juniper:ctpview:*:*:*:*:*:*:*:*
- cpe:2.3:a:juniper:ctpview:7.1:-:*:*:*:*:*:*
- cpe:2.3:a:juniper:ctpview:7.1:r1:*:*:*:*:*:*
- cpe:2.3:a:juniper:ctpview:7.2:-:*:*:*:*:*:*
More vulnerabilities in Udev Project Udev
- CVE-2011-0640 — Medium (CVSS 6.9): The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device…
- CVE-2010-4176 — Medium (CVSS 4.0): plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty…
- CVE-2009-1186 — Low (CVSS 2.1): Buffer overflow in the util_path_encode function in udev/lib/libudev-util.c in udev before 1.4.1 allows local users to…
All CVEs affecting Udev Project Udev →
Other CWE-346 vulnerabilities
- CVE-2026-42901 — Critical (CVSS 10.0): Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-6508 — Critical (CVSS 9.8): Origin Validation Error vulnerability in TUBITAK BILGEM Software Technologies Research Institute Liderahenk allows…
- CVE-2026-2790 — Critical (CVSS 9.8): Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR…
- CVE-2022-50925 — Critical (CVSS 9.8): Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send…
- CVE-2025-30466 — Critical (CVSS 9.8): This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS…
- CVE-2024-8487 — Critical (CVSS 9.8): A Cross-Origin Resource Sharing (CORS) vulnerability exists in modelscope/agentscope version v0.0.4. The CORS…