CVE-2008-0009

Status: ModifiedLow (2.1)—Exploit

Severity2.1Low · CVSS 2.0

Exploitation probability0.96 %higher than 61% of CVEs

Active exploitationNonot in the CISA catalog

Public exploitAvailablePublished on Exploit-DB

The vmsplice_to_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which might allow local users to access arbitrary kernel memory locations.

CVSS

Base score: 2.1
Version: 2.0
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.96 %
Percentile among all scored CVEs: 61
Score date: 10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Public exploits

Exploit code or detection templates are publicly available. This is not the same as confirmed active exploitation (KEV), but it raises the risk: patch with priority.

Published on Exploit-DB · Linux Kernel 2.6.17 < 2.6.24.1 - 'vmsplice' Local Privilege Escalation (2) (2/9/2008)
Published on Exploit-DB · Linux Kernel 2.6.23 < 2.6.24 - 'vmsplice' Local Privilege Escalation (1) (2/9/2008)

Affected technologies (1)

Linux — Linux Kernel

CWEs

CWE-20

References

Show 22 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2008-0009",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-02-12T21:00:00.000",
  "references": [
    {
      "url": "http://isec.pl/vulnerabilities/isec-0026-vmsplice_to_kernel.txt",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/28835",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/28896",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.24.1",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/487982/100/0/threaded",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/27704",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/27799",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0487/references",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=431206",
      "tags": [
        "Exploit"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00254.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00255.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://isec.pl/vulnerabilities/isec-0026-vmsplice_to_kernel.txt",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28835",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/28896",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.24.1",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/487982/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27704",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/27799",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/0487/references",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=431206",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00254.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00255.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vmsplice_to_user function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which might allow local users to access arbitrary kernel memory locations."
    },
    {
      "lang": "es",
      "value": "La función vmsplice_to_user en fs/splice.c del núcleo de Linux 2.6.22 hasta 2.6.24 no valida ciertos punteros en el espacio antes referenciados, lo cual permite a usuarios locales acceder a localizaciones de memoria del núcleo de su elección."
    }
  ],
  "lastModified": "2026-06-16T22:48:45.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "615BDD1D-36AA-4976-909B-F0F66BF1090C"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D123AAFE-3F17-45C4-9382-BA392FD022C4"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE8A26D6-1BDA-45F0-8F7C-F95986050E32"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F320FA9F-C13D-4AA3-B838-A0E5D63E6A29"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B179CF1D-084D-4B21-956F-E55AC6BDE026"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6F1B4877-286A-44B5-9C5C-0403F75B2BAA"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "432CA976-6EFA-4D34-B5EA-CD772D067F93"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E476195-657E-416E-BC16-44A18B06A133"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.22.16:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DFF566DA-0F04-48DA-AA40-565979C55328"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C6A3A30-FEA4-40B6-98A9-1840BB4E8CBE"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E249774-CE05-43D5-A5A3-7CCE24BB2AD9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D42BA44-C69B-4170-9867-CABF93CA9BD6"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5140380C-71BD-464F-AE53-1814C2653056"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B18EC0A7-8616-4039-B98B-E1216E035B05"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22FB141B-FA2A-435D-8937-83FC0669CB20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C59131C8-F66A-4380-9F6E-3FC14C7C8562"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5421616-4BF5-4269-8996-C3D2BA6AE2A1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23FC6CE2-8717-4558-A309-A441D322F00E"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "311BE336-7BB2-47C0-AED5-3DEA706C206F"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AAC2E9D-0E82-4866-9046-ADD448418198"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67F2047A-5F17-4B59-9075-41A5DC5C1CD1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.24:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A12DE15-E192-4B90-ADB7-A886B3746DD7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.24:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF6588E7-F4FA-40F5-8945-FC7B6094376E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not vulnerable. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.",
      "lastModified": "2008-02-13T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}