CVE-2009-1961

Advisory lineage Upstream: 0 Downstream: 2
Modified
Published: 06 Jun 2009, 18:00
Last modified:07 Aug 2024, 05:36

Vulnerability Summary

Overall Risk (default)
medium
29/100
CVSS Score
4.7 MEDIUM
v3.1 (nvd)
EPSS Score
0.11% LOW
0% probability -0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
5 found
Dark Web
Not detected

Timeline

06 Jun 2009, 18:00
Published
Vulnerability first disclosed
07 Aug 2024, 05:36
Last Modified
Vulnerability information updated

Description

The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (prevention of file creation and removal) via a series of splice system calls that trigger a deadlock between the generic_file_splice_write, splice_from_pipe, and ocfs2_file_splice_write functions.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • v2.0•LOW•Score: 1.9AV:L/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 0.11%• Percentile: 28%

Techniques & Countermeasures

  • CWE-667•Improper Locking

    The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Affected Systems

  • canonical•ubuntu_linux

    6.06 | 8.04 | 8.10 | 9.04

  • debian•debian_linux

    4.0

  • linux•linux_kernel

    ≤ 2.6.19 | ≥ 2.6.27, < 2.6.27.24 | ≥ 2.6.29, < 2.6.29.4 | 2.6.30:rc1 | 2.6.30:rc2

  • opensuse•opensuse

    10.3 | 11.1

  • suse•linux_enterprise

    11.0

  • suse•linux_enterprise_desktop

    11

  • suse•linux_enterprise_server

    11

References (20)