CVE-2009-1185: udev fails to validate NETLINK message origin, allowing local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityLocal, unauthenticated full root compromise with a very high EPSS score, though it is an old flaw requiring local access and is not in KEV.

What it is

udev before 1.4.1 does not verify whether a NETLINK message originates from kernel space, so a local user can send a crafted NETLINK message from user space and have it processed as if it came from the kernel. This is an origin validation error (CWE-346) in a core Linux device-management component, and it matters because it breaks the trust boundary between user and kernel messaging.

Impact

An attacker gains full root privileges on the affected host, with complete loss of confidentiality, integrity and availability as reflected in the CVSS 2.0 vector (C:C/I:C/A:C).

Attack surface

The flaw is reached locally through the NETLINK socket interface; the CVSS vector AV:L/AC:L/Au:N indicates no authentication and no user interaction are required, only local access to the system.

Exploitation

CVE-2009-1185 is not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high at 0.815 (99.6th percentile), indicating substantial observed or expected exploitation activity; reference tags are advisory and vendor links only, with no public exploit tag.

What to do

• Upgrade udev to 1.4.1 or later, or apply the vendor kernel/udev update from your distribution (Debian DSA-1772, Red Hat RHSA-2009-0427, openSUSE, Gentoo GLSA-200904-18, Slackware, Mandriva advisories).
• Confirm the patched udev package is installed and the udev daemon restarted or the host rebooted so the fix is active.
• Restrict local shell and interactive access to trusted users, since exploitation requires only a local account.
• Where udev cannot be updated, apply vendor workarounds or compensating controls such as mandatory access control policies limiting NETLINK use.
• Inventory embedded and appliance products (Juniper CTPView, VMware, rPath) that bundle udev and track their vendor advisories separately.

Detection

• Monitor for unexpected NETLINK socket creation and messages from non-root local processes, especially to the kernel connector or udev netlink groups.
• Alert on local privilege escalation indicators: processes gaining uid 0 without a legitimate setuid or sudo path, or udev spawning unexpected helper processes.
• Audit udev version across hosts and flag any system still running udev below 1.4.1.
• Correlate local logins or shell sessions with subsequent root-level process creation on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.