CVE-2008-2812 Null dereference in n/a

High 7.8 Published 9 Jul 2008 Updated 7 Aug 2024

Local users can crash the system or potentially gain privileges via NULL pointer dereferences in Linux kernel tty drivers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2008-2812?

CVE-2008-2812 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 9 Jul 2008. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.

Weakness: CWE-476

Which versions are affected by CVE-2008-2812?

It affects 15 products.

Products include Avaya Communication Manager, Avaya Expanded Meet-Me Conferencing, Avaya Intuity Audix Lx, Avaya Meeting Exchange, Avaya Message Networking, Avaya Messaging Storage Server and 9 more.

How do I fix CVE-2008-2812?

Apply the vendor's patch.

Is CVE-2008-2812 being exploited?

There is no known exploitation of CVE-2008-2812 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as GHSA-g469-pq25-x2qr.