CVE-2009-3939

Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 16 Nov 2009, 19:00
Last modified:07 Aug 2024, 06:45

Vulnerability Summary

Overall Risk (default)
medium
38/100
CVSS Score
7.1 HIGH
v3.1 (nvd)
EPSS Score
0.04% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

16 Nov 2009, 19:00
Published
Vulnerability first disclosed
07 Aug 2024, 06:45
Last Modified
Vulnerability information updated

Description

The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

CVSS Metrics

  • v3.1•HIGH•Score: 7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
  • v2.0•MEDIUM•Score: 6.6AV:L/AC:L/Au:N/C:N/I:C/A:C

EPSS Trends

Current EPSS score: 0.04%• Percentile: 14%

Techniques & Countermeasures

  • CWE-732•Incorrect Permission Assignment for Critical Resource

    The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Affected Systems

  • avaya•aura_application_enablement_services

    5.2 | 5.2.1

  • avaya•aura_communication_manager

    5.2

  • avaya•aura_session_manager

    1.1 | 5.2

  • avaya•aura_sip_enablement_services

    5.2

  • avaya•aura_system_manager

    5.2 | 6.0

  • avaya•aura_system_platform

    1.1

  • avaya•voice_portal

    5.0

  • canonical•ubuntu_linux

    6.06 | 8.04 | 8.10 | 9.04 | 9.10

  • debian•debian_linux

    5.0

  • linux•linux_kernel

    ≤ 2.6.31.6

  • opensuse•opensuse

    11.0 | 11.1 | 11.2

  • redhat•enterprise_linux_desktop

    5.0

  • redhat•enterprise_linux_eus

    5.4

  • redhat•enterprise_linux_server

    5.0

  • redhat•enterprise_linux_workstation

    5.0

  • redhat•virtualization

    5

  • suse•linux_enterprise_desktop

    10:sp3 | 11

  • suse•linux_enterprise_server

    10:sp3 | 11

References (23)