CVE-2008-5300

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Linux kernel 2.6.28 allows local users to cause a denial of service ("soft lockup" and process loss) via a large number of sendmsg function calls, which does not block during AF_UNIX garbage collection and triggers an OOM condition, a different vulnerability than CVE-2008-5029.

References

http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=473259

http://marc.info/?l=linux-netdev&m=122721862313564&w=2

http://marc.info/?l=linux-netdev&m=122765505415944&w=2

http://osvdb.org/50272

http://secunia.com/advisories/32913

http://secunia.com/advisories/32998

http://secunia.com/advisories/33083

http://secunia.com/advisories/33348

http://secunia.com/advisories/33556

http://secunia.com/advisories/33706

http://secunia.com/advisories/33756

http://secunia.com/advisories/33854

http://securityreason.com/securityalert/4673

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0332

http://www.debian.org/security/2008/dsa-1681

http://www.mandriva.com/security/advisories?name=MDVSA-2009:032

http://www.redhat.com/support/errata/RHSA-2009-0014.html

http://www.redhat.com/support/errata/RHSA-2009-0053.html

http://www.securityfocus.com/archive/1/499044/100/0/threaded

http://www.securityfocus.com/archive/1/512019/100/0/threaded

http://www.securityfocus.com/bid/32516

http://www.ubuntu.com/usn/usn-715-1

https://bugzilla.redhat.com/show_bug.cgi?id=470201

https://exchange.xforce.ibmcloud.com/vulnerabilities/46943

https://issues.rpath.com/browse/RPL-2915

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10283

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11427

https://rhn.redhat.com/errata/RHSA-2009-1550.html

https://usn.ubuntu.com/714-1/

https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01358.html

Details

Source: MITRE

Published: 2008-12-01

Updated: 2018-10-11

Type: CWE-399

Risk Information

CVSS v2

Base Score: 4.9

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 3.9

Severity: MEDIUM

Tenable Plugins

View all (19 total)

IDNameProductFamilySeverity
67955Oracle Linux 3 : kernel (ELSA-2009-1550)NessusOracle Linux Local Security Checks
high
67790Oracle Linux 4 : kernel (ELSA-2009-0014)NessusOracle Linux Local Security Checks
high
67070CentOS 3 : kernel (CESA-2009:1550)NessusCentOS Local Security Checks
high
63871RHEL 5 : kernel (RHSA-2009:0021)NessusRed Hat Local Security Checks
medium
60688Scientific Linux Security Update : kernel on SL3.x i386/x86_64NessusScientific Linux Local Security Checks
high
60520Scientific Linux Security Update : kernel on SL4.x i386/x86_64NessusScientific Linux Local Security Checks
high
47150VMSA-2010-0010 : ESX 3.5 third-party update for Service Console kernelNessusVMware ESX Local Security Checks
high
43727CentOS 4 : kernel (CESA-2009:0014)NessusCentOS Local Security Checks
high
42360RHEL 3 : kernel (RHSA-2009:1550)NessusRed Hat Local Security Checks
high
40011openSUSE Security Update : kernel (kernel-423)NessusSuSE Local Security Checks
high
37568Fedora 10 : kernel-2.6.27.9-159.fc10 (2008-11593)NessusFedora Local Security Checks
medium
37078Mandriva Linux Security Advisory : kernel (MDVSA-2009:032)NessusMandriva Local Security Checks
medium
36454Ubuntu 6.06 LTS / 7.10 / 8.04 LTS : linux-source-2.6.15/22, linux vulnerabilities (USN-714-1)NessusUbuntu Local Security Checks
critical
36279Ubuntu 8.10 : linux vulnerabilities (USN-715-1)NessusUbuntu Local Security Checks
high
35434RHEL 5 : kernel (RHSA-2009:0225)NessusRed Hat Local Security Checks
medium
35381RHEL 4 : kernel (RHSA-2009:0014)NessusRed Hat Local Security Checks
high
35264Fedora 9 : kernel-2.6.27.9-73.fc9 (2008-11618)NessusFedora Local Security Checks
medium
35036Debian DSA-1681-1 : linux-2.6.24 - denial of service/privilege escalationNessusDebian Local Security Checks
critical
801465CentOS RHSA-2009-0014 Security CheckLog Correlation EngineGeneric
high