CVE-2009-3620

Publication date 22 October 2009

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

7.8 · High

Score breakdown

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.

Status

Package Ubuntu Release Status
linux 9.10 karmic
Fixed 2.6.31-16.52
9.04 jaunty
Fixed 2.6.28-17.58
8.10 intrepid
Fixed 2.6.27-16.44
8.04 LTS hardy
Fixed 2.6.24-26.64
6.06 LTS dapper Not in release
linux-source-2.6.15 9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper
Fixed 2.6.15-55.81

Severity score breakdown

Parameter Value
Base score 7.8 · High
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Related Ubuntu Security Notices (USN)

    • USN-864-1
    • Linux kernel vulnerabilities
    • 5 December 2009

Other references