CVE-2008-2148: Low severity linux kernel vulnerability

Published May 12, 2008

Updated

The utimensat system call (sysutimensat) in Linux kernel 2.6.22 and other versions before 2.6.25.3 does not check file permissions when certain UTIMENOW and UTIMEOMIT combinations are used, which allows local users to modify file times of arbitrary files, possibly leading to a denial of service.

Affected Software

22 affected components

Linux Linux kernel=2.6.22.15

Linux Linux kernel=2.6.22.4

Linux Linux kernel=2.6.22.21

Linux Linux kernel=2.6.22.12

Linux Linux kernel=2.6.22.1

Linux Linux kernel=2.6.22

Linux Linux kernel=2.6.22.7

Linux Linux kernel=2.6.22.18

Linux Linux kernel=2.6.22.20

Linux Linux kernel=2.6.22.6

Linux Linux kernel=2.6.22.3

Linux Linux kernel=2.6.22.9

Linux Linux kernel=2.6.22.13

Linux Linux kernel=2.6.22.17

Linux Linux kernel=2.6.22.11

Linux Linux kernel=2.6.22.10

Linux Linux kernel=2.6.22.8

Linux Linux kernel=2.6.22.2

Linux Linux kernel=2.6.22.19

Linux Linux kernel=2.6.22.5

Linux Linux kernel=2.6.22.16

Linux Linux kernel=2.6.22.14

Event History

May 12, 2008

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-2148?

CVE-2008-2148 has a high severity rating due to the potential for local users to modify file timestamps arbitrarily.

How do I fix CVE-2008-2148?

To fix CVE-2008-2148, upgrade to Linux kernel version 2.6.25.3 or later, which contains the necessary security patches.

Which versions of the Linux kernel are affected by CVE-2008-2148?

CVE-2008-2148 affects Linux kernel versions from 2.6.22 to 2.6.25.2.

What type of vulnerability is CVE-2008-2148?

CVE-2008-2148 is a local privilege escalation vulnerability that allows unauthorized users to change file times.

Can CVE-2008-2148 lead to denial of service?

Yes, exploiting CVE-2008-2148 can lead to a denial of service by affecting file accessibility and timestamp integrity.