CVE-2009-3620
published 2009-10-22CVE-2009-3620: The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which…
PriorityP430high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.43%
34.5th percentile
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | < 2.6.31.1 | 2.6.31.1 |
| opensuse | opensuse | — | — |
| redhat | mrg_realtime | — | — |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
vendor_redhat7.8HIGH
vendor_ubuntu4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2009-12-05·CVSS 4.9
CVE-2009-3726 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Linux kernel vulnerabilities
It was discovered that the AX.25 network subsystem did not correctly
check integer signedness in certain setsockopt calls. A local attacker
could exploit this to crash the system, leading to a denial of service.
Ubuntu 9.10 was not affected. (CVE-2009-2909)
Jan Beulich discovered that the kernel could leak register contents to
32-bit processes that were switched to 64-bit mode. A local attacker
could run a specially crafted binary to read register values from an
earlier process, leading to a loss of privacy. (CVE-2009-2910)
Dave Jones discovered that the gdth SCSI driver did not correctly validate
array indexes in certain ioctl calls. A local attacker could exploit
this to crash the system or gain elevated privil
Red Hat
kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised
vendor_redhat·2009-08-30·CVSS 7.8
CVE-2009-3620 [HIGH] CWE-476 kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised
kernel: r128 IOCTL NULL pointer dereferences when CCE state is uninitialised
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
GHSA
GHSA-rgrv-jr8m-xv3m: The ATI Rage 128 (aka r128) driver in the Linux kernel before 2
ghsa_unreviewed·2022-05-02
CVE-2009-3620 [MEDIUM] CWE-20 GHSA-rgrv-jr8m-xv3m: The ATI Rage 128 (aka r128) driver in the Linux kernel before 2
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
No detection rules found.
No public exploits indexed.
CWE
Improper Initialization
mitre_cwe
CWE-665 Improper Initialization
CWE-665: Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
Modes of Introduction:
Phase: Implementation
Note: This weakness can occur in code paths that are not well-tested, such as rare error conditions. This is because the use of uninitialized data would be noticed as a bug during frequently-used functionality.
Phase: Operation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program
CWE
Use of Uninitialized Resource
mitre_cwe
CWE-908 Use of Uninitialized Resource
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory, Read Application Data. When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. The uninitialized resource may contain values that cause program flow to change in ways that t
CWE
NULL Pointer Dereference
mitre_cwe
CWE-476 NULL Pointer Dereference
CWE-476: NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Availability. Impact: DoS: Crash, Exit, or Restart. NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.
Scope: Integrity, Confidentiality. Impact: Execute Unauthorized Code or Commands, Read Memory, Modify Memory. In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code ex
http://article.gmane.org/gmane.linux.kernel/892259http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7dc482dfeeeefcfd000d4271c4626937406756d7http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://secunia.com/advisories/36707http://secunia.com/advisories/37909http://secunia.com/advisories/38794http://secunia.com/advisories/38834http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.31-git11.loghttp://www.mandriva.com/security/advisories?name=MDVSA-2010:088http://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.openwall.com/lists/oss-security/2009/10/19/1http://www.openwall.com/lists/oss-security/2009/10/19/3http://www.redhat.com/support/errata/RHSA-2009-1670.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1671.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0882.htmlhttp://www.securityfocus.com/bid/36824http://www.ubuntu.com/usn/usn-864-1http://www.vupen.com/english/advisories/2010/0528https://bugzilla.redhat.com/show_bug.cgi?id=529597https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6763https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9891https://rhn.redhat.com/errata/RHSA-2009-1540.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.htmlhttp://article.gmane.org/gmane.linux.kernel/892259http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7dc482dfeeeefcfd000d4271c4626937406756d7http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.htmlhttp://lists.vmware.com/pipermail/security-announce/2010/000082.htmlhttp://secunia.com/advisories/36707http://secunia.com/advisories/37909http://secunia.com/advisories/38794http://secunia.com/advisories/38834http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.31-git11.loghttp://www.mandriva.com/security/advisories?name=MDVSA-2010:088http://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.openwall.com/lists/oss-security/2009/10/19/1http://www.openwall.com/lists/oss-security/2009/10/19/3http://www.redhat.com/support/errata/RHSA-2009-1670.htmlhttp://www.redhat.com/support/errata/RHSA-2009-1671.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0882.htmlhttp://www.securityfocus.com/bid/36824http://www.ubuntu.com/usn/usn-864-1http://www.vupen.com/english/advisories/2010/0528https://bugzilla.redhat.com/show_bug.cgi?id=529597https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6763https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9891https://rhn.redhat.com/errata/RHSA-2009-1540.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-November/msg00190.html
2009-10-22
Published