CVE-2008-4934

Severity: high (CVSS 7.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-11-05 · updated 2026-06-16
Weakness: CWE-20

Description

The hfsplus_block_allocate function in fs/hfsplus/bitmap.c in the Linux kernel before 2.6.28-rc1 does not check a certain return value from the read_mapping_page function before calling kmap, which allows attackers to cause a denial of service (system crash) via a crafted hfsplus filesystem image.

Affected products

Canonical Ubuntu Linux: 6.06, 7.10, 8.04, 8.10
Debian Linux: 4.0
Linux kernel: before 2.6.28 — fixed in 2.6.28

How to fix

Upgrade to a fixed version: Linux kernel 2.6.28. Check the vendor advisory for mitigations.

References

http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.27.y.git%3Ba=commit%3Bh=649f1ee6c705aab644035a7998d7b574193a598a
http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.28-rc1
http://rhn.redhat.com/errata/RHSA-2009-0264.html
http://secunia.com/advisories/32510
http://secunia.com/advisories/32918
http://secunia.com/advisories/32998
http://secunia.com/advisories/33180
http://secunia.com/advisories/33556
http://secunia.com/advisories/33858
http://www.debian.org/security/2008/dsa-1681
http://www.debian.org/security/2008/dsa-1687
http://www.mandriva.com/security/advisories?name=MDVSA-2008:234

Get alerted when CVE-2008-4934 or the next vulnerability affects your stack