Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

Low

Attack Vector

Local

0

CVE-2009-1961

Disclosure Date: June 08, 2009 •

CVE-2009-1961 CVSS v3 Base Score: 4.7

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

4.7 Medium

Impact Score:

3.6

Exploitability Score:

1

Vector:

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector (AV):

Local

Attack Complexity (AC):

High

Privileges Required (PR):

Low

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

None

Integrity (I):

None

Availability (A):

High

Vendors

canonical,
debian,
linux,
opensuse,
suse

Products

debian linux 4.0,
linux enterprise 11.0,
linux enterprise desktop 11,
linux enterprise server 11,
linux kernel,
linux kernel 2.6.30,
opensuse 10.3,
opensuse 11.1,
ubuntu linux 6.06,
ubuntu linux 8.04,
ubuntu linux 8.10,
ubuntu linux 9.04

References

Canonical

CVE-2009-1961 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1961)

BID-35143 (http://www.securityfocus.com/bid/35143)

Advisory

SECUNIA-35390 (http://secunia.com/advisories/35390)

http://www.mandriva.com/security/advisories?name=MDVSA-2009:135

http://www.mandriva.com/security/advisories?name=MDVSA-2009:148

SECUNIA-35656 (http://secunia.com/advisories/35656)

DSA-1844 (http://www.debian.org/security/2009/dsa-1844)

SECTRACK-1022307 (http://securitytracker.com/id?1022307)

[oss-security] 20090602 Re: CVE request: kernel: splice local denial of service (http://www.openwall.com/lists/oss-security/2009/06/02/2)

http://www.redhat.com/support/errata/RHSA-2009-1157.html

http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.html

SECUNIA-36051 (http://secunia.com/advisories/36051)

http://git.kernel.org?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=7bfac9ecf0585962fe13584f5cf526d8c8e76f17

http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.html

USN-793-1 (http://www.ubuntu.com/usn/usn-793-1)

[oss-security] 20090530 Re: CVE request: kernel: splice local denial of service (http://www.openwall.com/lists/oss-security/2009/05/30/1)

[oss-security] 20090603 Re: CVE request: kernel: splice local denial of service (http://www.openwall.com/lists/oss-security/2009/06/03/1)

[oss-security] 20090529 CVE request: kernel: splice local denial of service (http://www.openwall.com/lists/oss-security/2009/05/29/2)

http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00004.html

SECUNIA-35394 (http://secunia.com/advisories/35394)

SECUNIA-35847 (http://secunia.com/advisories/35847)

Rapid7

Technical Analysis