Bug 294241

Summary:	Kernel: megaraid_sas: dbg_lvl file permissions too permissive (CVE-2009-3889)
Product:	Gentoo Security	Reporter:	Alex Legler (RETIRED) <a3li>
Component:	Kernel	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=66dca9b8c50b5e59d3bea8b21cee5c6dae6c9c46
Whiteboard:	[linux <2.6.27]
Package list:		Runtime testing required:	---

Description Alex Legler (RETIRED) archtester

2009-11-23 17:37:12 UTC

CVE-2009-3889 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3889):
  The dbg_lvl file for the megaraid_sas driver in the Linux kernel
  before 2.6.27 has world-writable permissions, which allows local
  users to change the (1) behavior and (2) logging level of the driver
  by modifying this file.