What’s Vulnerable › Vulnerabilities

CVE-2009-1633

• Severity: high (CVSS 7.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-05-28 · updated 2026-06-16
• Weakness: CWE-119

Description

Multiple buffer overflows in the cifs subsystem in the Linux kernel before 2.6.29.4 allow remote CIFS servers to cause a denial of service (memory corruption) and possibly have unspecified other impact via (1) a malformed Unicode string, related to Unicode string area alignment in fs/cifs/sess.c; or (2) long Unicode characters, related to fs/cifs/cifssmb.c and the cifs_readdir function in fs/cifs/readdir.c.

Affected products

• Canonical Ubuntu Linux: 6.06, 8.04, 8.10, 9.04
• Debian Linux: 4.0, 5.0
• Linux kernel: before 2.6.29.4 — fixed in 2.6.29.4

How to fix

Upgrade to a fixed version: Linux kernel 2.6.29.4. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git%3Ba=commit%3Bh=7b0c8fcff47a885743125dd843db64af41af5a61
• http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git%3Ba=commit%3Bh=968460ebd8006d55661dec0fb86712b40d71c413
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=27b87fe52baba0a55e9723030e76fce94fabcea4
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
• http://marc.info/?l=oss-security&m=124099284225229&w=2
• http://marc.info/?l=oss-security&m=124099371726547&w=2
• http://secunia.com/advisories/35217
• http://secunia.com/advisories/35226
• http://secunia.com/advisories/35298
• http://secunia.com/advisories/35656

Get alerted when CVE-2009-1633 or the next vulnerability affects your stack