Ubuntu.comUB:CVE-2009-3288CVE-2009-3288
4.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:N/I:N/A:C
0.0004 Low
EPSS
Percentile
9.0%
The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel
2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an
array, which allows local users to cause a denial of service (kernel OOPS
and NULL pointer dereference), as demonstrated by using xcdroast to
duplicate a CD. NOTE: this is only exploitable by users who can open the
cdrom device.
Related
4.9 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:N/I:N/A:C
0.0004 Low
EPSS
Percentile
9.0%