CVE-2009-1072: canonical ubuntu_linux Configuration
Vulnerability summary
CVE-2009-1072 is a medium (CVSS 4.9) Configuration vulnerability in canonical ubuntu_linux. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.
Not severe (CVSS 4.9, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4Timeline
- 25-03-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
nfsd in the Linux kernel before 2.6.28.9 does not drop the CAP_MKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the root_squash option.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.
Vmware5 products
- esx3.0.3 | 3.5 | 4.0
- server2.0.0
- vcenter_serverEOL4.0
- virtualcenter2.0.2 | 2.5
- vma4.0
Suse2 products
- linux_enterprise_desktop10:sp2
- linux_enterprise_server10:sp2
Canonical1 product
- ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04
Debian1 product
- debian_linuxEOL4.0 | 5.0
Linux1 product
- linux_kernel< 2.6.28.9
Opensuse1 product
- opensuseEOL10.3 | 11.0 | 11.1
6 vendors · 11 products
References
29 links- lists.opensuse.org/opensuse-security-announce/2009-05/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
Show all 29 references
- lists.opensuse.org/opensuse-security-announce/2009-06/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10314VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.securityfocus.com/archive/1/507985/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8382VDB EntrySignatureX Refsource OVALThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-06/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-04/msg00007.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- git.kernel.orgX Refsource CONFIRM