vulnwire
1.2low

CVE-2008-7256

mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly hand…

Published 16 y ago · modified 4 mo ago · JSON

CVSS
1.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 27%
Public exploits
0
none known

mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643.

Exploit prediction (EPSS)

0.34% probability of exploitation in the next 30 days, higher than 27% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.01.2AV:L/AC:H/Au:N/C:N/I:N/A:P

Classification

Technology feeds
Linux kernel (RSS, critical only)

References

  • mandriva.com /security/advisories?name=MDVSA-2010:198 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=595970 · x_refsource_CONFIRM, x_transferred
  • kernel.org /pub/linux/kernel/v2.6/testing/v2.6.28/ChangeLog-2.6.28-rc8 · x_refsource_CONFIRM, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/59224 · vdb-entry, x_refsource_XF, x_transferred
  • openwall.com /lists/oss-security/2010/05/27/1 · mailing-list, x_refsource_MLIST, x_transferred
  • git.kernel.org /?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1b79cd04fab80be61dcd2732e2423aa · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.