CVE-2008-2812

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-07-09 · updated 2026-06-16
Weakness: CWE-476

Description

The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/.

Affected products

Avaya Communication Manager: from 3.1
Avaya Expanded Meet-Me Conferencing: all versions
Avaya Intuity Audix Lx: 2.0
Avaya Meeting Exchange: 5.0
Avaya Message Networking: 3.1
Avaya Messaging Storage Server: 4.0
Avaya Proactive Contact: 4.0
Avaya Sip Enablement Services: 4.0
Canonical Ubuntu Linux: 6.06, 7.04, 7.10, 8.04
Debian Linux: 4.0
Linux kernel: before 2.6.25.10 — fixed in 2.6.25.10
Novell Linux Desktop: 9
Opensuse: 10.3, 11.0
Suse Linux Enterprise Desktop: 10-sp1, 10-sp2
SUSE Linux Enterprise: 10-sp1, 10-sp2

How to fix

Upgrade to a fixed version: Linux kernel 2.6.25.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2008-2812 or the next vulnerability affects your stack