CVE: CVE-2009-0935

Export to Word

The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial of service (OOPS) via a read with an invalid address to an inotify instance, which causes the device's event list mutex to be unlocked twice and prevents proper synchronization of a data structure for the inotify instance.

Threat-Mapped Scoring

Score: 1.5

Priority: P4 - Informational (Low)

S10 – Denial of Service

EPSS

Score: 0.00067
Percentile: 0.21097

CVSS Scoring

CVSS v3.1 Score: 5.5

Severity: MEDIUM

Mapped CWE(s)

CWE-667 : Improper Locking

All CAPEC(s)

CAPEC-25: Forced Deadlock
CAPEC-26: Leveraging Race Conditions
CAPEC-27: Leveraging Race Conditions via Symbolic Links

CAPEC(s) with Mapped TTPs

CAPEC-25: Forced Deadlock
Mapped TTPs:
- T1499.004 : Application or System Exploitation

Mapped ATT&CK TTPs

T1499.004 : Application or System Exploitation
Kill Chain: impact

Malware

Industroyer

APTs Threat Group Associations

Campaigns

Affected Products

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.29:rc3:*:*:*:*:*:*

← Back to Home