What’s Vulnerable › Vulnerabilities

CVE-2009-3939

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-11-16 · updated 2026-06-16
• Weakness: CWE-732

Description

The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.

Affected products

• Avaya Aura Application Enablement Services: 5.2, 5.2.1
• Avaya Aura Communication Manager: 5.2
• Avaya Aura Session Manager: 1.1, 5.2
• Avaya Aura Sip Enablement Services: 5.2
• Avaya Aura System Manager: 5.2, 6.0
• Avaya Aura System Platform: 1.1
• Avaya Voice Portal: 5.0
• Canonical Ubuntu Linux: 6.06, 8.04, 8.10, 9.04, 9.10
• Debian Linux: 5.0
• Linux kernel: through 2.6.31.6
• Opensuse: 11.0, 11.1, 11.2
• RedHat Enterprise Linux Desktop: 5.0
• RedHat Enterprise Linux Eus: 5.4
• RedHat Enterprise Linux Server: 5.0
• RedHat Enterprise Linux Workstation: 5.0
• RedHat Virtualization: 5
• SUSE Linux Enterprise Server 15 SP1: 10-sp3, 11
• SUSE Linux Enterprise Server: 10-sp3, 11

References

• http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00000.html
• http://osvdb.org/60201
• http://secunia.com/advisories/37909
• http://secunia.com/advisories/38017
• http://secunia.com/advisories/38276
• http://secunia.com/advisories/38492

Get alerted when CVE-2009-3939 or the next vulnerability affects your stack