CVE-2009-3725

Advisory lineage Upstream: 0 Downstream: 1

Downstream

DSA-2012-1

Modified

Published: 06 Nov 2009, 15:00

Last modified:07 Aug 2024, 06:38

Vulnerability Summary

Overall Risk (default)

medium

39/100

CVSS Score

7.2 HIGH

v2.0 (nvd)

EPSS Score

0.04% LOW

0% probability 0.00%

KEV

Not listed

Ransomware

No reports

Public exploits

1 found

Dark Web

Not detected

Timeline

06 Nov 2009, 15:00

Published

Vulnerability first disclosed

07 Aug 2024, 06:38

Last Modified

Vulnerability information updated

Description

The connector layer in the Linux kernel before 2.6.31.5 does not require the CAP_SYS_ADMIN capability for certain interaction with the (1) uvesafb, (2) pohmelfs, (3) dst, or (4) dm subsystem, which allows local users to bypass intended access restrictions and gain privileges via calls to functions in these subsystems.

CVSS Metrics

v2.0•HIGH•Score: 7.2AV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.04%• Percentile: 14%

Techniques & Countermeasures

CWE-264•Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected Systems

canonical•ubuntu_linux
6.06 | 8.04 | 8.10 | 9.04 | 9.10
linux•linux_kernel
< 2.6.31.5