4.6

CVE-2009-3286

EPSS 0.1%
Published 22.09.2009 10:30:00
Last modified 09.04.2025 00:30:58
Source cve@mitre.org
Teams watchlist Login
Open Login

NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails.

Affected products Warnungen 0 Metrics 2 CWE 0 References 16

Data is provided by the National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version2.6.18

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.1%	0.239

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.6	3.9	6.4	AV:L/AC:L/Au:N/C:P/I:P/A:P

http://lists.vmware.com/pipermail/security-announce/2010/000082.html

http://secunia.com/advisories/38794

Vendor Advisory

http://www.vupen.com/english/advisories/2010/0528

Vendor Advisory

http://secunia.com/advisories/38834

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html

http://secunia.com/advisories/37105

Vendor Advisory

http://www.ubuntu.com/usn/USN-852-1

https://rhn.redhat.com/errata/RHSA-2009-1548.html

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=81ac95c5

http://www.openwall.com/lists/oss-security/2009/09/21/2

https://bugzilla.redhat.com/show_bug.cgi?id=524520

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7527

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9757

https://nvd.nist.gov/vuln/detail/CVE-2009-3286

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2009-3286

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2009-3286

EUVD