CVE-2008-3272: Infoleak
Published Aug 8, 2008
·Updated
The sndseqosssynthmakeinfo function in sound/core/seq/oss/seqosssynth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by maxsynthdev before returning certain data to the caller, which allows local users to obtain sensitive information.
Affected Software
12 affected components
Linux Linux kernel=2.6.27-rc1
Linux Linux kernel<2.6.27
Linux Linux kernel=2.6.27
Debian Debian Linux=4.0
Canonical Ubuntu Linux=6.06
Canonical Ubuntu Linux=7.04
Canonical Ubuntu Linux=7.10
Canonical Ubuntu Linux=8.04
redhat Enterprise Linux Desktop=4.0
redhat Enterprise Linux Eus=4.7
redhat Enterprise Linux Server=4.0
redhat Enterprise Linux Workstation=4.0
Event History
Aug 8, 2008
CVE Published
via MITRE·06:12 PM
Data Sourced
via MITRE·06:12 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3272?
CVE-2008-3272 has been designated a low to medium severity vulnerability.
2
How do I fix CVE-2008-3272?
To mitigate CVE-2008-3272, upgrade your Linux kernel to version 2.6.27-rc2 or later.
3
Which versions of Linux are affected by CVE-2008-3272?
CVE-2008-3272 affects Linux kernel versions prior to 2.6.27-rc2.
4
Can CVE-2008-3272 be exploited remotely?
CVE-2008-3272 is a local privilege escalation vulnerability and cannot be exploited remotely.
5
What component of the Linux kernel is vulnerable in CVE-2008-3272?
CVE-2008-3272 affects the sound subsystem specifically within the snd_seq_oss_synth_make_info function.