CVE-2009-3288

Linux kernel 2.6.28-rc1-2.6.31-rc8 - Denial of Service via sg_build_indirect Array Access

Title source: llm
STIX 2.1

Description

The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.

References (5)

Core 5
Core References
Exploit mailing-list x_refsource_mlist
http://lkml.org/lkml/2009/9/3/107
Exploit mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/09/03/4
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-852-1
Exploit mailing-list x_refsource_mlist
http://lkml.org/lkml/2009/9/3/1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/37105

Scores

EPSS 0.0044
EPSS Percentile 35.4%

Details

CWE
CWE-119
Status published
Products (10)
kernel/linux_kernel 2.6.28-rc1
linux/linux_kernel 2.6.31-rc2
linux/linux_kernel 2.6.31-rc3
linux/linux_kernel 2.6.31-rc4
linux/linux_kernel 2.6.31-rc5
linux/linux_kernel 2.6.31-rc6
linux/linux_kernel 2.6.31-rc7
linux/linux_kernel 2.6.31-rc8
linux/linux_kernel 2.6.31-rc9
linux/linux_kernel 2.6.31-rc10
Published Sep 22, 2009
Tracked Since Feb 18, 2026