CVE-2009-2846 Information disclosure in n/a
Local attackers can read restricted memory in the Linux kernel parisc isa-eeprom driver via a negative offset, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-2846?
CVE-2009-2846 is a high-severity vulnerability in Linux kernel, published on 18 Aug 2009. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The eisa_eeprom_read function in the parisc isa-eeprom component (drivers/parisc/eisa_eeprom.c) in the Linux kernel before 2.6.31-rc6 allows local users to access restricted memory via a negative ppos argument, which bypasses a check that assumes that ppos is positive and causes an out-of-bounds read in the readb function.
Weakness: CWE-264
Which versions are affected by CVE-2009-2846?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2009-2846?
Upgrade to a fixed version.
Is CVE-2009-2846 being exploited?
There is no known exploitation of CVE-2009-2846 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as GHSA-4rcc-2rmf-f973.