vulnwire
4.4med

CVE-2007-4849

JFFS2, as used on One Laptop Per Child (OLPC) build 542 and possibly other Linux systems, when POSIX ACL support is enabled, does not prope…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
4.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 28%
Public exploits
0
none known

JFFS2, as used on One Laptop Per Child (OLPC) build 542 and possibly other Linux systems, when POSIX ACL support is enabled, does not properly store permissions during (1) inode creation or (2) ACL setting, which might allow local users to access restricted files or directories after a remount of a filesystem, related to "legacy modes" and an inconsistency between dentry permissions and inode permissions.

Exploit prediction (EPSS)

0.34% probability of exploitation in the next 30 days, higher than 28% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.4AV:L/AC:M/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • lists.infradead.org /pipermail/linux-mtd-cvs/2007-August/005897.html · mailing-list, x_refsource_MLIST, x_transferred
  • secunia.com /advisories/26978 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/28706 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /bid/25838 · vdb-entry, x_refsource_BID, x_transferred
  • git.infradead.org /?p=mtd-2.6.git%3Ba=commitdiff%3Bh=9ed437c50d89eabae763dd422579f73fdebf288d · x_refsource_CONFIRM, x_transferred
  • dev.laptop.org /ticket/2732 · x_refsource_CONFIRM, x_transferred
  • ubuntu.com /usn/usn-558-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • ubuntu.com /usn/usn-574-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/28170 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2007/dsa-1378 · vendor-advisory, x_refsource_DEBIAN, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.