4.6

CVE-2009-3286

EPSS 0.1%
Veröffentlicht 22.09.2009 10:30:00
Zuletzt bearbeitet 09.04.2025 00:30:58
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 16

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version2.6.18

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.1%	0.239

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.6	3.9	6.4	AV:L/AC:L/Au:N/C:P/I:P/A:P

http://lists.vmware.com/pipermail/security-announce/2010/000082.html

http://secunia.com/advisories/38794

Vendor Advisory

http://www.vupen.com/english/advisories/2010/0528

Vendor Advisory

http://secunia.com/advisories/38834

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html

http://secunia.com/advisories/37105

Vendor Advisory

http://www.ubuntu.com/usn/USN-852-1

https://rhn.redhat.com/errata/RHSA-2009-1548.html

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=81ac95c5

http://www.openwall.com/lists/oss-security/2009/09/21/2

https://bugzilla.redhat.com/show_bug.cgi?id=524520

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7527

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9757

https://nvd.nist.gov/vuln/detail/CVE-2009-3286

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2009-3286

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2009-3286

EUVD