1. CVE-Search
  2. CVE-2008-3686
ID CVE-2008-3686
Summary The rt6_fill_node function in net/ipv6/route.c in Linux kernel 2.6.26-rc4, 2.6.26.2, and possibly other 2.6.26 versions, allows local users to cause a denial of service (kernel OOPS) via IPv6 requests when no IPv6 input device is in use, which triggers a NULL pointer dereference.
References
Vulnerable Configurations
  • cpe:2.3:o:linux:linux_kernel:2.6.26:rc4:*:*:*:*:*:*
    cpe:2.3:o:linux:linux_kernel:2.6.26:rc4:*:*:*:*:*:*
  • cpe:2.3:o:linux:linux_kernel:2.6.26.2:*:*:*:*:*:*:*
    cpe:2.3:o:linux:linux_kernel:2.6.26.2:*:*:*:*:*:*:*
CVSS
Base: 4.9 (as of 08-08-2017 - 01:32)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:N/I:N/A:C
refmap via4
confirm http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5e0115e500fe9dd2ca11e6f92db9123204f1327a
mlist
  • [linux-kernel] 20080807 OOPS, ip -f inet6 route get fec0::1, linux-2.6.26, ip6_route_output, rt6_fill_node+0x175
  • [linux-kernel] 20080808 Re: OOPS, ip -f inet6 route get fec0::1, linux-2.6.26, ip6_route_output, rt6_fill_node+0x175
secunia 31579
vupen ADV-2008-2422
xf linux-kernel-rt6fillnode-dos(44605)
statements via4
contributor Tomas Hoger
lastmodified 2008-08-18
organization Red Hat
statement Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 2.1, 3, 4, 5 or Red Hat Enterprise MRG.
Last major update 08-08-2017 - 01:32
Published 14-08-2008 - 22:41
Last modified 08-08-2017 - 01:32
Back to Top