CVE-2008-3272

Published: Aug 8, 2008Modified: Apr 23, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.

Affected (12)

Products: Linux: Linux Kernel · Debian: Debian Linux · Canonical: Ubuntu Linux · +1 more

Show all products

Linux: Linux Kernel · Debian: Debian Linux · Canonical: Ubuntu Linux · Redhat: Enterprise Linux Desktop, Enterprise Linux Eus, Enterprise Linux Server, Enterprise Linux Workstation

1 product

1 product

1 product

4 products

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Workstation

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 2.6.27
Linux Linux Kernel	Version 2.6.27
Linux Linux Kernel	Version 2.6.27 rc1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 4.0
Redhat Enterprise Linux Eus	Version 4.7
Redhat Enterprise Linux Server	Version 4.0
Redhat Enterprise Linux Workstation	Version 4.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (62)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82e68f7ffec3800425f2391c8c86277606860442

Source: secalert@redhat.com

http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.27-rc2

Source: secalert@redhat.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2008-0972.html

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31366

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31551

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31614

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31836

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/31881

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32023

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32103

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32104

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32190

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32370

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32759

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/32799

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1630

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2008/dsa-1636

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:220

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0857.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0885.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/30559

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020636

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2008/2307

Source: secalert@redhat.com

Third Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/44225

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11182

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/637-1/

Source: secalert@redhat.com

Third Party Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82e68f7ffec3800425f2391c8c86277606860442