Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 22 Sep 2009 03:21:19 -0400 (EDT)
From: "Steven M. Christey" <>
cc: "Steven M. Christey" <>
Subject: Re: CVE request: kernel: NULL pointer dereference in

Name: CVE-2009-3288
Status: Candidate
Reference: MLIST:[linux-kernel] 20090902 [BUG] 2.6.31-rc8 readcd Oops
Reference: URL:
Reference: MLIST:[linux-kernel] 20090903 [PATCH] sg: fix oops in the error path in sg_build_indirect()
Reference: URL:
Reference: MLIST:[oss-security] 20090904 CVE request: kernel: NULL pointer dereference in sg_build_indirect()
Reference: URL:

The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel
2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when
accessing an array, which allows local users to cause a denial of
service (kernel OOPS and NULL pointer dereference), as demonstrated by
using xcdroast to duplicate a CD.  NOTE: this is only exploitable by
users who can open the cdrom device.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.