CVEvulnerability
CVE-2009-3286
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-09-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does not properly clean up an inode when an O_EXCL create fails, which causes files to be created with insecure settings such as setuid bits, and possibly allows local users to gain privileges, related to the execution of the do_open_permission function even when a create fails.
Affected configurations
• linux linux kernel 2.6.18
Related
Weakness · not in database (1)
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=81ac95c5 git.kernel.org
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html lists.opensuse.org
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html lists.vmware.com
- http://secunia.com/advisories/37105 Vendor Advisory
- http://secunia.com/advisories/38794 Vendor Advisory
- http://secunia.com/advisories/38834 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2009/09/21/2 www.openwall.com
- http://www.ubuntu.com/usn/USN-852-1 www.ubuntu.com
- http://www.vupen.com/english/advisories/2010/0528 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=524520 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7527 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9757 oval.cisecurity.org
- https://rhn.redhat.com/errata/RHSA-2009-1548.html rhn.redhat.com
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=81ac95c5 git.kernel.org
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html lists.opensuse.org
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html lists.vmware.com
- http://secunia.com/advisories/37105 Vendor Advisory
- http://secunia.com/advisories/38794 Vendor Advisory
- http://secunia.com/advisories/38834 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2009/09/21/2 www.openwall.com
- http://www.ubuntu.com/usn/USN-852-1 www.ubuntu.com
- http://www.vupen.com/english/advisories/2010/0528 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=524520 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7527 oval.cisecurity.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9757 oval.cisecurity.org
- https://rhn.redhat.com/errata/RHSA-2009-1548.html rhn.redhat.com