CVE-2007-0822 : umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allow

umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.

Published 2007-02-07 20:28:00

Updated 2010-09-15 05:43:52

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2007-0822

Linux » Linux Kernel » Version: 2.6.15
cpe:2.3:o:linux:linux_kernel:2.6.15:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2007-0822

Top countries where our scanners detected CVE-2007-0822

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2007-0822 276

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2007-0822!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2007-0822

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-0822

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
1.9	LOW	AV:L/AC:M/Au:N/C:P/I:N/A:N	3.4	2.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

Vendor statements for CVE-2007-0822

Red Hat 2007-02-09

Red Hat does not consider this issue to be a security vulnerability. On Red Hat Enterprise Linux processes that change their effective UID do not dump core by default when they receive a fatal signal. Therefore the NULL pointer dereference does not lead to an information leak.

References for CVE-2007-0822