CVE-2008-3275 — Classic Buffer Overflow in Kernel

CWE-120 — Classic Buffer Overflow6 documents6 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 77.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Linux KernelCanonical Ubuntu LinuxDebian Linux+2 more
Timeline
PublishedAug 12
Latest updateMay 1

Description

The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDlinux/linux_kernel< 2.6.25.15

Also affects: Debian Linux 4.0, Ubuntu Linux 6.06, 7.04, 7.10, 8.04

Patches

Patch: www.debian.org ↗Patch: www.debian.org ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9q47-jv6r-8hwf: The (1) real_lookup and (2) __lookup_hash functions in fs/namei↗2022-05-01
▶
CVEList
CVE-2008-3275: The (1) real_lookup and (2) __lookup_hash functions in fs/namei↗2008-08-12
▶

📋Vendor Advisories

2
Ubuntu
Linux kernel vulnerabilities↗2008-08-25
▶
Red Hat
Linux kernel local filesystem DoS↗2008-07-02
▶

💬Community

1
Bugzilla
CVE-2008-3275 Linux kernel local filesystem DoS↗2008-08-05
▶
CVE-2008-3275 — Classic Buffer Overflow in Linux Kernel | cvebase