CveMateVulnerability intelligence

CVE-2008-3528: linux linux_kernel

Modified

Published 27-09-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-3528 is a low (CVSS 2.1) vulnerability in linux linux_kernel. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.5% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 2.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

2.1/10

010

Low · v2.0 (NVD)

EPSS score

0.53%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 5

DSA-1681-1 DSA-1687-1 RHSA-2008:0972 RHSA-2009:0009 RHSA-2009:0326

Timeline

27-09-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations. NOTE: there are limited scenarios in which this crosses privilege boundaries.

CVSS metrics

1 score · 1 source · 1 version

v2.02.1

EPSS trend

Probability

0.53%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.53% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (lkml.org)
Maturity: unknown
referenceUnverified
Exploit Reference (lkml.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected systems

Version check

Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.

Linux1 product

linux_kernel2.6.26.5

1 vendor · 1 product

References

38 links

secunia.com/advisories/32998Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.openwall.com/lists/oss-security/2008/09/18/2Mailing ListX Refsource MLIST
www.redhat.com/support/errata/RHSA-2009-0326.htmlVendor AdvisoryX Refsource REDHAT
lkml.org/lkml/2008/9/17/371Mailing ListX Refsource MLIST
www.mandriva.com/security/advisories?name=MDVSA-2008:224Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/37471Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lkml.org/lkml/2008/9/13/98Mailing ListX Refsource MLISTExploit
rhn.redhat.com/errata/RHSA-2008-0972.htmlVendor AdvisoryX Refsource REDHAT
www.vmware.com/security/advisories/VMSA-2009-0016.htmlX Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.htmlVendor AdvisoryX Refsource SUSE

Show all 38 references

secunia.com/advisories/33758Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2009-0009.htmlVendor AdvisoryX Refsource REDHAT
lists.opensuse.org/opensuse-security-announce/2008-10/msg00010.htmlVendor AdvisoryX Refsource SUSE
bugzilla.redhat.com/show_bug.cgi?id=459577X Refsource CONFIRM
exchange.xforce.ibmcloud.com/vulnerabilities/45720VDB EntryX Refsource XF
lists.opensuse.org/opensuse-security-announce/2008-12/msg00000.htmlVendor AdvisoryX Refsource SUSE
www.ubuntu.com/usn/usn-662-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/33586Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/32509Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/32709Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.debian.org/security/2008/dsa-1687Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/32356Third Party AdvisoryX Refsource SECUNIA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8642VDB EntrySignatureX Refsource OVAL
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10852VDB EntrySignatureX Refsource OVAL
wiki.rpath.com/Advisories:rPSA-2008-0316X Refsource CONFIRM
wiki.rpath.com/wiki/Advisories:rPSA-2008-0316X Refsource CONFIRM
secunia.com/advisories/32759Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lkml.org/lkml/2008/9/13/99Mailing ListX Refsource MLISTExploit
secunia.com/advisories/33180Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/32370Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2008-10/msg00007.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/32799Third Party AdvisoryX Refsource SECUNIAVendor Advisory
lists.opensuse.org/opensuse-security-announce/2008-12/msg00001.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.htmlVendor AdvisoryX Refsource SUSE
www.debian.org/security/2008/dsa-1681Vendor AdvisoryX Refsource DEBIAN
www.vupen.com/english/advisories/2009/3316VDB EntryX Refsource VUPENVendor Advisory
www.securityfocus.com/archive/1/498285/100/0/threadedMailing ListX Refsource BUGTRAQ