Bug 286098 (CVE-2009-3288)

Summary:	Kernel: sg_build_indirect() NULL pointer deref (CVE-2009-3288)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	hardened-kernel+disabled, kernel
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e71044ee2efa4792e21d243b03d49006db66aec9
Whiteboard:	[ linux > 2.6.28 < 2.6.31 ]
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-09-23 14:31:07 UTC

CVE-2009-3288 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3288):
  The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel
  2.6.28-rc1 through 2.6.31-rc8 uses an incorrect variable when
  accessing an array, which allows local users to cause a denial of
  service (kernel OOPS and NULL pointer dereference), as demonstrated
  by using xcdroast to duplicate a CD.  NOTE: this is only exploitable
  by users who can open the cdrom device.