// For flags

CVE-2008-3272

kernel snd_seq_oss_synth_make_info leak

Severity Score

2.1
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.

La función snd_seq_oss_synth_make_info de sound/core/seq/oss/seq_oss_synth.c en el subsistema sound de Linux kernel versiones anteriores a 2.6.27-rc2 no verifica que el número de dispositivo esté dentro del rango definido por max_synthdev antes de retornar determinados datos del emisor, lo cual permite a usuarios locales obtener información sensible.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-07-24 CVE Reserved
  • 2008-08-08 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (33)
URL Tag Source
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82e68f7ffec3800425f2391c8c86277606860442 X_refsource_confirm
http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.27-rc2 Broken Link
http://secunia.com/advisories/31366 Third Party Advisory
http://secunia.com/advisories/31551 Third Party Advisory
http://secunia.com/advisories/31614 Third Party Advisory
http://secunia.com/advisories/31836 Third Party Advisory
http://secunia.com/advisories/31881 Third Party Advisory
http://secunia.com/advisories/32023 Third Party Advisory
http://secunia.com/advisories/32103 Third Party Advisory
http://secunia.com/advisories/32104 Third Party Advisory
http://secunia.com/advisories/32190 Third Party Advisory
http://secunia.com/advisories/32370 Third Party Advisory
http://secunia.com/advisories/32759 Third Party Advisory
http://secunia.com/advisories/32799 Third Party Advisory
http://www.securityfocus.com/bid/30559 Third Party Advisory
http://www.securitytracker.com/id?1020636 Third Party Advisory
http://www.vupen.com/english/advisories/2008/2307 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44225 Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11182 Signature
URL Date SRC
URL Date SRC
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html 2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html 2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html 2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00008.html 2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html 2023-02-13
http://rhn.redhat.com/errata/RHSA-2008-0972.html 2023-02-13
http://www.debian.org/security/2008/dsa-1630 2023-02-13
http://www.debian.org/security/2008/dsa-1636 2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2008:220 2023-02-13
http://www.redhat.com/support/errata/RHSA-2008-0857.html 2023-02-13
http://www.redhat.com/support/errata/RHSA-2008-0885.html 2023-02-13
https://usn.ubuntu.com/637-1 2023-02-13
https://access.redhat.com/security/cve/CVE-2008-3272 2008-11-19
https://bugzilla.redhat.com/show_bug.cgi?id=457995 2008-11-19
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 < 2.6.27
Search vendor "Linux" for product "Linux Kernel" and version " < 2.6.27"
-
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 2.6.27
Search vendor "Linux" for product "Linux Kernel" and version "2.6.27"
-
Affected
Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
 2.6.27
Search vendor "Linux" for product "Linux Kernel" and version "2.6.27"
rc1
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 4.0
Search vendor "Debian" for product "Debian Linux" and version "4.0"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 6.06
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"
lts
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.10"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 8.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04"
lts
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux Desktop
Search vendor "Redhat" for product "Enterprise Linux Desktop"
 4.0
Search vendor "Redhat" for product "Enterprise Linux Desktop" and version "4.0"
-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux Eus
Search vendor "Redhat" for product "Enterprise Linux Eus"
 4.7
Search vendor "Redhat" for product "Enterprise Linux Eus" and version "4.7"
-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux Server
Search vendor "Redhat" for product "Enterprise Linux Server"
 4.0
Search vendor "Redhat" for product "Enterprise Linux Server" and version "4.0"
-
Affected
Redhat
Search vendor "Redhat"
 Enterprise Linux Workstation
Search vendor "Redhat" for product "Enterprise Linux Workstation"
 4.0
Search vendor "Redhat" for product "Enterprise Linux Workstation" and version "4.0"
-
Affected