CVE-2009-3288

2009-09-2210:30:00

CWE-119

mitre

web.nvd.nist.gov

cve-2009-3288

sg_build_indirect

linux kernel

denial of service

vulnerability

nvd

cdrom

array access

null pointer dereference

CVSS2

4.9

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

AI Score

7.1

Confidence

High

EPSS

Percentile

9.8%

JSON

The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.

Affected configurations

Nvd

Node

kernellinux_kernelMatch2.6.28-rc1

linuxlinux_kernelMatch2.6.31-rc2

linuxlinux_kernelMatch2.6.31-rc3

linuxlinux_kernelMatch2.6.31-rc4

linuxlinux_kernelMatch2.6.31-rc5

linuxlinux_kernelMatch2.6.31-rc6

linuxlinux_kernelMatch2.6.31-rc7

linuxlinux_kernelMatch2.6.31-rc8

linuxlinux_kernelMatch2.6.31-rc9

linuxlinux_kernelMatch2.6.31-rc10

VendorProductVersionCPE
linuxlinux_kernel2.6.31-rc2cpe:/o:linux:linux_kernel:2.6.31-rc2:::
linuxlinux_kernel2.6.31-rc5cpe:/o:linux:linux_kernel:2.6.31-rc5:::
linuxlinux_kernel2.6.31-rc8cpe:/o:linux:linux_kernel:2.6.31-rc8:::
linuxlinux_kernel2.6.31-rc6cpe:/o:linux:linux_kernel:2.6.31-rc6:::
kernellinux_kernel2.6.28-rc1cpe:/a:kernel:linux_kernel:2.6.28-rc1:::
linuxlinux_kernel2.6.31-rc3cpe:/o:linux:linux_kernel:2.6.31-rc3:::
linuxlinux_kernel2.6.31-rc9cpe:/o:linux:linux_kernel:2.6.31-rc9:::
linuxlinux_kernel2.6.31-rc10cpe:/o:linux:linux_kernel:2.6.31-rc10:::
linuxlinux_kernel2.6.31-rc7cpe:/o:linux:linux_kernel:2.6.31-rc7:::
linuxlinux_kernel2.6.31-rc4cpe:/o:linux:linux_kernel:2.6.31-rc4:::

Vendor	Product	Version	CPE
linux	linux_kernel	2.6.31-rc2	cpe:/o:linux:linux_kernel:2.6.31-rc2:::
linux	linux_kernel	2.6.31-rc5	cpe:/o:linux:linux_kernel:2.6.31-rc5:::
linux	linux_kernel	2.6.31-rc8	cpe:/o:linux:linux_kernel:2.6.31-rc8:::
linux	linux_kernel	2.6.31-rc6	cpe:/o:linux:linux_kernel:2.6.31-rc6:::
kernel	linux_kernel	2.6.28-rc1	cpe:/a:kernel:linux_kernel:2.6.28-rc1:::
linux	linux_kernel	2.6.31-rc3	cpe:/o:linux:linux_kernel:2.6.31-rc3:::
linux	linux_kernel	2.6.31-rc9	cpe:/o:linux:linux_kernel:2.6.31-rc9:::
linux	linux_kernel	2.6.31-rc10	cpe:/o:linux:linux_kernel:2.6.31-rc10:::
linux	linux_kernel	2.6.31-rc7	cpe:/o:linux:linux_kernel:2.6.31-rc7:::
linux	linux_kernel	2.6.31-rc4	cpe:/o:linux:linux_kernel:2.6.31-rc4:::