Unscored CVE-2009-3288 EUVD-2009-3270GHSA-jq84-chq4-ww9x

The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing…

Published Sep 22, 2009 · Updated Aug 7, 2024 · Assigned by mitre

Description

The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel 2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when accessing an array, which allows local users to cause a denial of service (kernel OOPS and NULL pointer dereference), as demonstrated by using xcdroast to duplicate a CD. NOTE: this is only exploitable by users who can open the cdrom device.

References

[linux-kernel] 20090903 [PATCH] sg: fix oops in the error path in sg_build_indirect() mailing-list
[oss-security] 20090904 CVE request: kernel: NULL pointer dereference in sg_build_indirect() mailing-list
USN-852-1 vendor-advisory
[linux-kernel] 20090902 [BUG] 2.6.31-rc8 readcd Oops mailing-list
37105 third-party-advisory