vulnwire
2.1low

CVE-2008-3528

The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does…

Published 18 y ago · modified 4 mo ago · JSON

CVSS
2.1
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 45%
Public exploits
0
none known

The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries.

Exploit prediction (EPSS)

0.53% probability of exploitation in the next 30 days, higher than 45% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.02.1AV:L/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
Technology feeds
Linux kernel (RSS, critical only)

References

  • secunia.com /advisories/32998 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • openwall.com /lists/oss-security/2008/09/18/2 · mailing-list, x_refsource_MLIST, x_transferred
  • redhat.com /support/errata/RHSA-2009-0326.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lkml.org /lkml/2008/9/17/371 · mailing-list, x_refsource_MLIST, x_transferred
  • mandriva.com /security/advisories?name=MDVSA-2008:224 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • secunia.com /advisories/37471 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lkml.org /lkml/2008/9/13/98 · mailing-list, x_refsource_MLIST, x_transferred
  • rhn.redhat.com /errata/RHSA-2008-0972.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • vmware.com /security/advisories/VMSA-2009-0016.html · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-10/msg00008.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • secunia.com /advisories/33758 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • redhat.com /support/errata/RHSA-2009-0009.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-10/msg00010.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=459577 · x_refsource_CONFIRM, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/45720 · vdb-entry, x_refsource_XF, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-12/msg00000.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • ubuntu.com /usn/usn-662-1 · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • secunia.com /advisories/33586 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32509 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • securityfocus.com /archive/1/507985/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • secunia.com /advisories/32709 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • debian.org /security/2008/dsa-1687 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • secunia.com /advisories/32356 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8642 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10852 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • wiki.rpath.com /Advisories:rPSA-2008-0316 · x_refsource_CONFIRM, x_transferred
  • wiki.rpath.com /wiki/Advisories:rPSA-2008-0316 · x_refsource_CONFIRM, x_transferred
  • secunia.com /advisories/32759 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lkml.org /lkml/2008/9/13/99 · mailing-list, x_refsource_MLIST, x_transferred
  • secunia.com /advisories/33180 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • secunia.com /advisories/32370 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-10/msg00007.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • secunia.com /advisories/32799 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-12/msg00001.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2008-11/msg00001.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • debian.org /security/2008/dsa-1681 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • vupen.com /english/advisories/2009/3316 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securityfocus.com /archive/1/498285/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.