Buffer overflow in Kernel Linux
CVE-2009-3288
The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.
Vulnerability class: Buffer Overflow
EPSS: 0.004 (36.0th percentile) — read the EPSS interpretation.
Affected products
- Kernel Linux_kernel — versions 2.6.28-rc1
- Linux Linux_kernel — versions 2.6.31-rc2, 2.6.31-rc3, 2.6.31-rc4
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (mailing-list, x_refsource_MLIST, Exploit)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Exploit)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
- cve@mitre.org (mailing-list, x_refsource_MLIST, Exploit)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)