CVE-2008-3272
No CVSS score yet. EPSS 0.4% chance of exploitation in the next 30 days.
The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- linux:linux_kernel
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_workstation
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82e68f7ffec3800425f2391c8c86277606860442
- http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.27-rc2
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html