« Volver al listado

CVE-2009-3288

Estado: ModificadaMedia (4.9)—

The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Kernel — Linux KernelLinux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3288",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-09-22T10:30:00.670",
  "references": [
    {
      "url": "http://lkml.org/lkml/2009/9/3/1",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lkml.org/lkml/2009/9/3/107",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/37105",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/09/03/4",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-852-1",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lkml.org/lkml/2009/9/3/1",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lkml.org/lkml/2009/9/3/107",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37105",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2009/09/03/4",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-852-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD.  NOTE: this is only exploitable by users who can open the cdrom device."
    },
    {
      "lang": "es",
      "value": "La función sg_build_indirect en drivers/scsi/sg.c en el kernel de linux v 2.6.28-rc1 a la v2.6.31-rc8 emplea una variable incorrecta cuando accede a una matriz, lo que permite a usuarios locales provocar una denegación de servicio (Kernel OOPS y una deferencia a puntero NULL), como se ha demostrado usando xcdroast para duplicar un CD. NOTA: esto es explotable únicamente por usuarios que pueden abrir la unidad de CD."
    }
  ],
  "lastModified": "2026-06-16T23:11:18.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:kernel:linux_kernel:2.6.28-rc1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB876AB2-97A5-42DE-AC69-C564513FA837"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C86BC69-06B6-45C7-9821-45D42D44B240"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA0353B9-907F-4B89-9104-2F4434159F0F"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D1FF505-4135-4005-BD1A-3AC913FEE20A"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D31D04B-1E65-4FD6-AEED-3F365C65FCDE"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24CFD647-3926-462F-B264-56E136B74F81"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE71B9D7-B52E-426A-831D-ADEDC38318E1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6FFA2CD-0EC9-4FBB-93DC-80736622CFCA"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B64401A9-58F5-4CB6-B0E2-A3A2B92659EE"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.31-rc10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89137307-D97D-4D8B-9291-21DE1E6C56D3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5 or Red Hat Enterprise MRG. This issue was introduced by upstream commit 10db10d1, and only affected kernels version 2.6.28-rc1 and later.",
      "lastModified": "2009-09-22T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}