Vulnerability Details : CVE-2008-2931
The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.
Vulnerability category: Denial of service
Products affected by CVE-2008-2931
- cpe:2.3:o:novell:suse_linux_enterprise_server:10.0:sp1:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_server:10.0:sp2:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_desktop:10.0:sp1:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_desktop:10.0:sp2:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*
- cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*
Threat overview for CVE-2008-2931
Top countries where our scanners detected CVE-2008-2931
Top open port discovered on systems with this issue
53
IPs affected by CVE-2008-2931 1,291
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2008-2931!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2008-2931
0.02%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 4 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-2931
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2008-2931
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2008-2931
-
Red Hat 2009-01-15This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, and Red Hat Enterprise MRG. It was addressed in Red Hat Enterprise Linux 5 via: https://rhn.redhat.com/errata/RHSA-2008-0885.html
References for CVE-2008-2931
-
http://www.debian.org/security/2008/dsa-1630
Patch;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2008/07/08/3
Mailing List;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/43696
Third Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00012.html
Mailing List;Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2008/07/08/4
Mailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2008:025 - openSUSE Security Announce - openSUSE Mailing ListsMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00007.html
Mailing List;Third Party Advisory
-
https://usn.ubuntu.com/637-1/
Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=454388
Issue Tracking;Patch;Third Party Advisory
-
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=ee6f958291e2a768fd727e7a67badfff0b67711a
-
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html
Mailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/30126
Third Party Advisory;VDB Entry
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10437
Third Party Advisory
Jump to