Improper Access Control

2019-05-0205:03:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

JSON

A flaw was found in the way the Linux kernel’s floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory.

CPENameOperatorVersion
kernel-rteq3.8.13__rt27.33.el6rt
kernel-rteq3.0.36__rt57.66.el6rt
kernel-rteq3.8.13__rt14.20.el6rt
kernel-rteq3.6.11__rt28.20.el6rt
kernel-rteq3.6.11.2__rt33.39.el6rt
kernel-rteq3.8.13__rt27.40.el6rt
kernel-rteq2.6.33.9__rt31.66.el6rt
kernel-rteq3.8.13__rt27.34.el6rt
kernel-rteq3.0.25__rt44.57.el6rt
kernel-rteq3.0.18__rt34.53.el6rt

Name	Operator	Version
kernel-rt	eq	3.8.13__rt27.33.el6rt
kernel-rt	eq	3.0.36__rt57.66.el6rt
kernel-rt	eq	3.8.13__rt14.20.el6rt
kernel-rt	eq	3.6.11__rt28.20.el6rt
kernel-rt	eq	3.6.11.2__rt33.39.el6rt
kernel-rt	eq	3.8.13__rt27.40.el6rt
kernel-rt	eq	2.6.33.9__rt31.66.el6rt
kernel-rt	eq	3.8.13__rt27.34.el6rt
kernel-rt	eq	3.0.25__rt44.57.el6rt
kernel-rt	eq	3.0.18__rt34.53.el6rt