CVE-2009-4307
6.9 Medium
AI Score
Confidence
High
7.1 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
0.029 Low
EPSS
Percentile
90.7%
The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).
References
bugzilla.kernel.org/show_bug.cgi?id=14287
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=503358ae01b70ce6909d19dd01287093f6b6271c
lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html
lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html
lkml.org/lkml/2009/12/9/255
secunia.com/advisories/37658
secunia.com/advisories/38017
secunia.com/advisories/38276
www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.32-git6.log
www.mandriva.com/security/advisories?name=MDVSA-2011:029
www.redhat.com/support/errata/RHSA-2010-0380.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9874
Social References
More
Related
6.9 Medium
AI Score
Confidence
High
7.1 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:N/I:N/A:C
0.029 Low
EPSS
Percentile
90.7%