CVE-2008-4302: debian debian_linux Improper Locking

Modified

Published 29-09-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4302 is a medium (CVSS 5.5) Improper Locking vulnerability in debian debian_linux. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 49.5% of scored vulnerabilities. 2 public exploits are recorded.

Priority

Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.5/10

010

Medium · v3.1 (NVD)

EPSS score

0.62%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 2

DSA-1653-1 RHSA-2008:0957

Timeline

29-09-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

fs/splice.c in the splice subsystem in the Linux kernel before 2.6.22.2 does not properly handle a failure of the add_to_page_cache_lru function, and subsequently attempts to unlock a page that was not locked, which allows local users to cause a denial of service (kernel BUG and system crash), as demonstrated by the fio I/O tool.

CVSS metrics

2 scores · 1 source · 2 versions

v3.15.5v2.04.9

EPSS trend

Probability

0.62%

Chance of exploitation in the next 30 days

Percentile

50%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.62% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found

referenceUnverified
Exploit Reference (lkml.org)
Maturity: unknown
exploit-databasedoslinuxVerified
Linux Kernel 2.6.x - 'add_to_page_cache_lru()' Local Denial of Service
Maturity: poc