1. Home
  2. CVE Database
  3. CVE-2009-3624
MEDIUM · 4.6

CVE-2009-3624

The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows l...

Vulnerability Description

The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.

CVSS Score

4.6

MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
PARTIAL

Affected Products

VendorProductVersions
LinuxKernel2.6.24.7
LinuxLinux Kernel<= 2.6.32

Related Weaknesses (CWE)

CWE-310

References

FAQ

What is CVE-2009-3624?

CVE-2009-3624 is a vulnerability with a CVSS score of 4.6 (MEDIUM). The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows l...

How severe is CVE-2009-3624?

CVE-2009-3624 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2009-3624?

Check the references section above for vendor advisories and patch information. Affected products include: Linux Kernel, Linux Linux Kernel.