CVE-2008-2729medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
arch/x86_64/lib/copy_user.S in the Linux kernel before 2.6.19 on some AMD64 systems does not erase destination memory locations after an exception during kernel memory copy, which allows local users to obtain sensitive information.
References
http://rhn.redhat.com/errata/RHSA-2008-0508.html
http://secunia.com/advisories/30849
http://secunia.com/advisories/30850
http://secunia.com/advisories/31107
http://secunia.com/advisories/31551
http://secunia.com/advisories/31628
http://www.debian.org/security/2008/dsa-1630
http://www.mandriva.com/security/advisories?name=MDVSA-2008:174
http://www.redhat.com/support/errata/RHSA-2008-0519.html
http://www.redhat.com/support/errata/RHSA-2008-0585.html
http://www.securityfocus.com/bid/29943
http://www.securitytracker.com/id?1020364
http://www.ubuntu.com/usn/usn-625-1
https://bugzilla.redhat.com/show_bug.cgi?id=451271
https://exchange.xforce.ibmcloud.com/vulnerabilities/43558
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11571
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:red_hat:linux_kernel:2.6.0:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.1:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.2:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.3:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.4:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.5:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.6:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.7:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.8:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.9:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.10:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.11:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.12:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.13:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.14:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.15:*:*:*:*:*:*:*
cpe:2.3:o:red_hat:linux_kernel:2.6.16:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 67706 | Oracle Linux 5 : kernel (ELSA-2008-0519) | Nessus | Oracle Linux Local Security Checks | high |
| 67703 | Oracle Linux 4 : kernel (ELSA-2008-0508) | Nessus | Oracle Linux Local Security Checks | high |
| 60430 | Scientific Linux Security Update : kernel on SL5.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | high |
| 60429 | Scientific Linux Security Update : kernel on SL4.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | high |
| 43692 | CentOS 5 : kernel (CESA-2008:0519) | Nessus | CentOS Local Security Checks | high |
| 34032 | Debian DSA-1630-1 : linux-2.6 - denial of service/information leak | Nessus | Debian Local Security Checks | high |
| 33531 | Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : linux, linux-source-2.6.15/20/22 vulnerabilities (USN-625-1) | Nessus | Ubuntu Local Security Checks | critical |
| 33377 | RHEL 5 : kernel (RHSA-2008:0519) | Nessus | Red Hat Local Security Checks | high |
| 33376 | RHEL 4 : kernel (RHSA-2008:0508) | Nessus | Red Hat Local Security Checks | high |
| 33365 | CentOS 4 : kernel (CESA-2008:0508) | Nessus | CentOS Local Security Checks | high |
| 801454 | CentOS RHSA-2008-0519 Security Check | Log Correlation Engine | Generic | high |