CVE DATABASE / CVE-2009-3620
CVE-2009-3620
CVSS 7.8 · HIGH
Summary
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
CVSS 3.1 breakdown
| Base score | 7.8 (HIGH) |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | LOCAL |
| Attack complexity | LOW |
| Privileges required | LOW |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | HIGH |
| Integrity | HIGH |
| Availability | HIGH |
Weakness type (CWE)
Affected products
Linux linux kernelFedoraproject fedoraCanonical ubuntu linuxRedhat mrg realtimeSuse linux enterprise debuginfoOpensuse opensuseSuse linux enterprise desktopSuse linux enterprise server
Check this CVE live
Use our free CVE Lookup tool for the latest NVD record, or browse the full CISA KEV catalog.
References
- http://article.gmane.org/gmane.linux.kernel/892259
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7dc482dfeeeefcfd000d4271c4626937406756d7
- http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html
- http://secunia.com/advisories/36707
- http://secunia.com/advisories/37909
- http://secunia.com/advisories/38794
- http://secunia.com/advisories/38834
- http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.31-git11.log
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:088
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:198
- http://www.openwall.com/lists/oss-security/2009/10/19/1
Data: NIST NVD. NVD last modified 2026-04-23. Always verify against the vendor advisory before acting.