Vulnerability Details : CVE-2008-2826
Integer overflow in the sctp_getsockopt_local_addrs_old function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) functionality in the Linux kernel before 2.6.25.9 allows local users to cause a denial of service (resource consumption and system outage) via vectors involving a large addr_num field in an sctp_getaddrs_old data structure.
Vulnerability category: OverflowDenial of service
Threat overview for CVE-2008-2826
Top countries where our scanners detected CVE-2008-2826
Top open port discovered on systems with this issue
53
IPs affected by CVE-2008-2826 1,530
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2008-2826!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2008-2826
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 8 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-2826
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
NIST |
CWE ids for CVE-2008-2826
-
The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-2826
-
http://www.debian.org/security/2008/dsa-1630
Third Party Advisory
-
http://www.ubuntu.com/usn/usn-625-1
Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00009.html
Mailing List;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/43559
Third Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html
Mailing List;Third Party Advisory
-
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=735ce972fbc8a65fb17788debd7bbe7b4383cc62
Patch;Vendor Advisory
-
http://www.vupen.com/english/advisories/2008/2511
Third Party Advisory
-
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.9
Broken Link
-
http://www.securityfocus.com/bid/29990
Third Party Advisory;VDB Entry
-
http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.36.7
Broken Link
-
http://www.securitytracker.com/id?1020514
Third Party Advisory;VDB Entry
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:174
Third Party Advisory
-
http://lwn.net/Articles/287350/
Third Party Advisory
-
http://www.mandriva.com/security/advisories?name=MDVSA-2008:167
Third Party Advisory
-
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0207
Broken Link
-
https://issues.rpath.com/browse/RPL-2629
Broken Link
-
http://www.redhat.com/support/errata/RHSA-2008-0585.html
Third Party Advisory
Products affected by CVE-2008-2826
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*