CVE-2008-0009: Input Validation
Description of problem:
A new system call named vmsplice() was introduced in the 2.6.17 release of the Linux kernel.
Inappropriate dereference of user-supplied memory pointers in the code beginning at line 1378 in the vmsplicetouser() kernel function (fs/splice.c):
The patch for this issue not provided by the reporter.
Other sources
The vmsplicetouser function in fs/splice.c in the Linux kernel 2.6.22 through 2.6.24 does not validate a certain userspace pointer before dereference, which might allow local users to access arbitrary kernel memory locations.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-0009?
CVE-2008-0009 is classified as a medium severity vulnerability due to the potential for local privilege escalation.
How do I fix CVE-2008-0009?
To fix CVE-2008-0009, users should upgrade the Linux kernel to a version greater than 2.6.24.1.
Which Linux kernel versions are affected by CVE-2008-0009?
CVE-2008-0009 affects Linux kernel versions from 2.6.22 up to 2.6.24-rc3.
Can CVE-2008-0009 be exploited remotely?
No, CVE-2008-0009 requires local access to the affected system to be exploited.
What components of the Linux kernel does CVE-2008-0009 impact?
CVE-2008-0009 impacts the vmsplice system call within the Linux kernel.