CVE-2007-4308

kernel: Missing ioctl() permission checks in aacraid driver

Severity Score

7.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The (1) aac_cfg_open and (2) aac_compat_ioctl functions in the SCSI layer ioctl path in aacraid in the Linux kernel before 2.6.23-rc2 do not check permissions for ioctls, which might allow local users to cause a denial of service or gain privileges.

Las funciones (1) aac_cfg_open y (2) aac_compat_ioctl en la ruta ioctl de la capa SCSI en el núcleo de Linux anterior a 2.6.23-rc2 no comprueba los permisos para ioctls, lo cual podría permitir a usuarios locales provocar una denegación de servicio u obtener privilegios.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2007-08-13 CVE Reserved
2007-08-13 CVE Published
2024-08-07 CVE Updated
2025-01-05 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CAPEC

References (42)

URL	Tag	Source
http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.23-rc2	X_refsource_confirm
http://lists.vmware.com/pipermail/security-announce/2008/000005.html	Mailing List
http://lkml.org/lkml/2007/7/23/195	X_refsource_confirm
http://secunia.com/advisories/26643	Third Party Advisory
http://secunia.com/advisories/26647	Third Party Advisory
http://secunia.com/advisories/26651	Third Party Advisory
http://secunia.com/advisories/27212	Third Party Advisory
http://secunia.com/advisories/27322	Third Party Advisory
http://secunia.com/advisories/27436	Third Party Advisory
http://secunia.com/advisories/27747	Third Party Advisory
http://secunia.com/advisories/27912	Third Party Advisory
http://secunia.com/advisories/27913	Third Party Advisory
http://secunia.com/advisories/28806	Third Party Advisory
http://secunia.com/advisories/29032	Third Party Advisory
http://secunia.com/advisories/29058	Third Party Advisory
http://secunia.com/advisories/29570	Third Party Advisory
http://secunia.com/advisories/33280	Third Party Advisory
http://securitytracker.com/id?1019470	Vdb Entry
http://support.avaya.com/elmodocs2/security/ASA-2007-474.htm	X_refsource_confirm
http://www.securityfocus.com/archive/1/488457/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/25216	Vdb Entry
http://www.vupen.com/english/advisories/2007/2786	Vdb Entry
http://www.vupen.com/english/advisories/2008/0637	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8872	Signature

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00001.html	2018-10-15
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00002.html	2018-10-15
http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00007.html	2018-10-15
http://secunia.com/advisories/26322	2018-10-15
http://www.debian.org/security/2007/dsa-1363	2018-10-15
http://www.debian.org/security/2008/dsa-1503	2018-10-15
http://www.debian.org/security/2008/dsa-1504	2018-10-15
http://www.mandriva.com/security/advisories?name=MDKSA-2007:195	2018-10-15
http://www.mandriva.com/security/advisories?name=MDKSA-2007:196	2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-0939.html	2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-0940.html	2018-10-15
http://www.redhat.com/support/errata/RHSA-2007-1049.html	2018-10-15
http://www.redhat.com/support/errata/RHSA-2008-0787.html	2018-10-15
http://www.ubuntu.com/usn/usn-508-1	2018-10-15
http://www.ubuntu.com/usn/usn-509-1	2018-10-15
http://www.ubuntu.com/usn/usn-510-1	2018-10-15
https://access.redhat.com/security/cve/CVE-2007-4308	2009-01-08
https://bugzilla.redhat.com/show_bug.cgi?id=252309	2009-01-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Adaptec Search vendor "Adaptec"	Aacraid Controller Search vendor "Adaptec" for product "Aacraid Controller"	*	-	Affected	in	Linux Search vendor "Linux"	Linux Kernel Search vendor "Linux" for product "Linux Kernel"	2.6.23 Search vendor "Linux" for product "Linux Kernel" and version "2.6.23"	rc1	Safe