CVE-2008-2931 | Vulnetix

CVE-2008-2931 PUBLISHED CVSS 7.199999809265137 HIGH

The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.

EPSS 0.37% · 30.3th percentile

Risk Scores

CVSS 2.0

7.199999809265137

EPSS Score

0.37%

30.3th percentile

Affected Products

Vendor	Product	Versions
opensuse	opensuse	10.3
novell	suse_linux_enterprise_server	10.0, 10.0
linux	linux_kernel	0
novell	suse_linux_enterprise_desktop	10.0, 10.0
n/a	n/a	n/a
canonical	ubuntu_linux	6.06, 7.04, 7.10
debian	debian_linux	4.0

Timeline

Jul 9, 2008 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 4, 2022 EPSS Score
Oct 27, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
May 26, 2023 EPSS Score

References

USN-637-1 vendor-advisory
SUSE-SA:2008:035 vendor-advisory
30982 third-party-advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=ee6f958291e2a768fd727e7a67badfff0b67711a url
[oss-security] 20080708 Re: CVE-2008-2931 kernel: missing check before setting mount propagation mailing-list
30126 vdb
32023 third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=454388 url
[oss-security] 20080708 CVE-2008-2931 kernel: missing check before setting mount propagation mailing-list
SUSE-SR:2008:025 vendor-advisory
DSA-1630 vendor-advisory
linux-kernel-dochangetype-priv-escalation(43696) vdb
RHSA-2008:0885 vendor-advisory
SUSE-SA:2008:038 vendor-advisory
oval:org.mitre.oval:def:10437 vdb
31614 third-party-advisory
31551 third-party-advisory
32759 third-party-advisory
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22 url
SUSE-SA:2008:049 vendor-advisory

…and 3 more

Open in Interactive Console →