CVE-2008-4554: Medium severity linux kernel vulnerability
Published Oct 13, 2008
·Updated
Description of problem: Miklos Szeredi reported that splice() to files opened with OAPPEND are ignored, which allows users to bypass the append-only restriction.
Other sources
The dosplicefrom function in fs/splice.c in the Linux kernel before 2.6.27 does not reject file descriptors that have the OAPPEND flag set, which allows local users to bypass append mode and make arbitrary changes to other locations in the file.
— MITRE
Affected Software
106 affected components
Linux Linux kernel=2.6.25.4
Linux Linux kernel=2.6.25.11
Linux Linux kernel=2.6.26-rc4
Linux Linux kernel=2.6.18-rc3
Linux Linux kernel=2.6.25.9
Linux Linux kernel=2.6.22.15
Linux Linux kernel=2.6.24.7
Linux Linux kernel=2.6.18-rc2
Linux Linux kernel=2.6.23.13
Linux Linux kernel=2.6.24.2
Linux Linux kernel=2.4.36.6
Linux Linux kernel=2.6.18-rc5
Linux Linux kernel=2.6.18-rc4
Linux Linux kernel=2.6.22.21
Linux Linux kernel=2.6.25.12
Linux Linux kernel=2.6.25.5
Linux Linux kernel=2.6.23.8
Linux Linux kernel=2.6.25
Linux Linux kernel=2.6.22.12
Linux Linux kernel=2.6.25.8
Linux Linux kernel=2.6.21.6
Linux Linux kernel=2.4.36.2
Linux Linux kernel=2.6.22.1
Linux Linux kernel=2.6.23.16
Linux Linux kernel=2.6.24.1
Linux Linux kernel=2.6.25.6
Linux Linux kernel=2.6.22
Linux Linux kernel=2.6.26.3
Linux Linux kernel=2.6.20.16
Linux Linux kernel=2.6.25.9
Linux Linux kernel=2.6.19.4
Linux Linux kernel=2.6.25.13
Linux Linux kernel=2.6.20.21
Linux Linux kernel=2.6.25.7
Linux Linux kernel=2.4.36.1
Linux Linux kernel=2.6.25.3
Linux Linux kernel=2.6.24
Linux Linux kernel=2.6.26.2
Linux Linux kernel=2.6.20.17
Linux Linux kernel=2.6.21.5
Linux Linux kernel=2.6.25.15
Linux Linux kernel=2.6.24_rc4
Linux Linux kernel=2.6.23.15
Linux Linux kernel=2.6.23.10
Linux Linux kernel=2.4.36.4
Linux Linux kernel=2.6.26.1
Linux Linux kernel=2.6.20.20
Linux Linux kernel=2.6.22.18
Linux Linux kernel=2.6.25.8
Linux Linux kernel=2.4.36.3
Linux Linux kernel=2.6.22.20
Linux Linux kernel=2.6.20.18
Linux Linux kernel=2.6.23.9
Linux Linux kernel=2.6.25.2
Linux Linux kernel=2.6.25.1
Linux Linux kernel=2.6.24.4
Linux Linux kernel=2.6.22.9
Linux Linux kernel=2.6.22.13
Linux Linux kernel=2.6.19.7
Linux Linux kernel=2.6.24.5
Linux Linux kernel=2.6.24_rc1
Linux Linux kernel=2.6.20.19
Linux Linux kernel=2.6.22.17
Linux Linux kernel=2.6.25.10
Linux Linux kernel=2.6.22.11
Linux Linux kernel=2.6.23
Linux Linux kernel=2.6.22.10
Linux Linux kernel=2.6.23.17
Linux Linux kernel=2.6.25.1
Linux Linux kernel=2.6.25.4
Linux Linux kernel=2.6.25.3
Linux Linux kernel=2.6.21.7
Linux Linux kernel=2.6.23_rc1
Linux Linux kernel=2.6.22.22
Linux Linux kernel=2.6.18-rc7
Linux Linux kernel=2.6.25.5
Linux Linux kernel=2.6.24.6
Linux Linux kernel=2.6.22_rc7
Linux Linux kernel=2.4.36
Linux Linux kernel=2.6.23.12
Linux Linux kernel=2.6.24_rc5
Linux Linux kernel=2.6.19.6
Linux Linux kernel=2.6.25.11
Linux Linux kernel=2.6.18-rc6
Linux Linux kernel=2.6.22.8
Linux Linux kernel=2.6.19.5
Linux Linux kernel=2.6.18
Linux Linux kernel=2.4.36.5
Linux Linux kernel<=2.6.26.5
Linux Linux kernel=2.6.22.2
Linux Linux kernel=2.2.27
Linux Linux kernel=2.6.22.19
Linux Linux kernel=2.6.24.3
Linux Linux kernel=2.6.22_rc1
Linux Linux kernel=2.6.25
Linux Linux kernel=2.6.25.2
Linux Linux kernel=2.6.25.7
Linux Linux kernel=2.6.25.14
Linux Linux kernel=2.6.26.4
Linux Linux kernel=2.6.25.12
Linux Linux kernel=2.6.25.6
Linux Linux kernel=2.6.18-rc1
Linux Linux kernel=2.6.23.11
Linux Linux kernel=2.6.22.14
Linux Linux kernel=2.6.25.10
Linux Linux kernel=2.6
Event History
Oct 13, 2008
Data Sourced
06:02 AM
DescriptionSeverityAffected Software
Oct 15, 2008
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-4554?
CVE-2008-4554 has a medium severity rating, as it allows bypass of the append-only restriction.
2
How do I fix CVE-2008-4554?
To fix CVE-2008-4554, upgrade to a Linux kernel version later than 2.6.27.
3
What systems are affected by CVE-2008-4554?
CVE-2008-4554 affects Linux kernel versions prior to 2.6.27, including various older versions.
4
What type of vulnerability is CVE-2008-4554?
CVE-2008-4554 is a file system vulnerability that allows users to bypass file permissions.
5
Who reported CVE-2008-4554?
CVE-2008-4554 was reported by Miklos Szeredi.