What’s Vulnerable › Vulnerabilities

CVE-2008-3275

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2008-08-12 · updated 2026-06-16
• Weakness: CWE-120

Description

The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a deleted (aka S_DEAD) directory, which allows local users to cause a denial of service ("overflow" of the UBIFS orphan area) via a series of attempted file creations within deleted directories.

Affected products

• Canonical Ubuntu Linux: 6.06, 7.04, 7.10, 8.04
• Debian Linux: 4.0
• Linux kernel: before 2.6.25.15 — fixed in 2.6.25.15
• Suse Linux Enterprise Desktop: 10-sp1
• SUSE Linux Enterprise: 10-sp1

How to fix

Upgrade to a fixed version: Linux kernel 2.6.25.15. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d70b67c8bc72ee23b55381bd6a884f4796692f77
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.25.15
• http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00003.html
• http://lkml.org/lkml/2008/7/2/83
• http://secunia.com/advisories/31551
• http://secunia.com/advisories/31614
• http://secunia.com/advisories/31836
• http://secunia.com/advisories/31881
• http://secunia.com/advisories/32023
• http://secunia.com/advisories/32104
• http://secunia.com/advisories/32190

Get alerted when CVE-2008-3275 or the next vulnerability affects your stack