CVE-2009-3288

2009-09-2210:30:00

CWE-119

[email protected]

web.nvd.nist.gov

cve-2009-3288

sg_build_indirect

linux kernel

denial of service

vulnerability

nvd

cdrom

array access

null pointer dereference

6.2 Medium

AI Score

Confidence

Low

4.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:N/A:C

0.0004 Low

EPSS

Percentile

9.0%

JSON

The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.

CPENameOperatorVersion
linux:linux_kernellinux linux kerneleq2.6.31-rc6
linux:linux_kernellinux linux kerneleq2.6.31-rc10
linux:linux_kernellinux linux kerneleq2.6.31-rc4
linux:linux_kernellinux linux kerneleq2.6.31-rc5
linux:linux_kernellinux linux kerneleq2.6.31-rc3
linux:linux_kernellinux linux kerneleq2.6.31-rc8
linux:linux_kernellinux linux kerneleq2.6.31-rc2
kernel:linux_kernelkernel linux kerneleq2.6.28-rc1
linux:linux_kernellinux linux kerneleq2.6.31-rc9
linux:linux_kernellinux linux kerneleq2.6.31-rc7

CPE	Name	Operator	Version
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc6
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc10
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc4
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc5
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc3
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc8
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc2
kernel:linux_kernel	kernel linux kernel	eq	2.6.28-rc1
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc9
linux:linux_kernel	linux linux kernel	eq	2.6.31-rc7