CVE-2008-3275

Published: Aug 12, 2008Modified: Apr 23, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.

Affected (8)

Products: Linux: Linux Kernel · Debian: Debian Linux · Canonical: Ubuntu Linux · +1 more

Show all products

Linux: Linux Kernel · Debian: Debian Linux · Canonical: Ubuntu Linux · Suse: Suse Linux Enterprise Desktop, Suse Linux Enterprise Server

1 product

1 product

1 product

2 products

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 2.6.25.15

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 4.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10
Canonical Ubuntu Linux	Version 8.04

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Suse Suse Linux Enterprise Desktop	Version 10 sp1
Suse Suse Linux Enterprise Server	Version 10 sp1

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (64)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d70b67c8bc72ee23b55381bd6a884f4796692f77

Source: secalert@redhat.com

http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.15

Source: secalert@redhat.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lkml.org/lkml/2008/7/2/83

Source: secalert@redhat.com

ExploitMailing ListThird Party Advisory

http://secunia.com/advisories/31551

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31614

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31836

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/31881

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32023

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32104

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32190

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/32344

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/33201

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/33280

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/33556

Source: secalert@redhat.com

Broken Link

http://www.debian.org/security/2008/dsa-1630

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.debian.org/security/2008/dsa-1636

Source: secalert@redhat.com

PatchThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:220

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0787.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0857.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0885.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0973.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2009-0014.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/bid/30647

Source: secalert@redhat.com

PatchThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1020739

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2008/2430

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=457858

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/44410

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10744

Source: secalert@redhat.com

Third Party Advisory

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6551

Source: secalert@redhat.com

Third Party Advisory

https://usn.ubuntu.com/637-1/

Source: secalert@redhat.com

Third Party Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d70b67c8bc72ee23b55381bd6a884f4796692f77