CVE-2012-4542

kernel: block: default SCSI command filter does not accomodate commands overlap across device classes

Published Feb 28, 2013 CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Description
block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2012-4470 block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 8:42 PM
Reserved
Aug 21, 2012, 12:00 AM
Status
Modified
Published
Feb 28, 2013, 7:55 PM
Modified
Jun 16, 2026, 11:45 PM
Severity
Moderate
Public date
Jan 24, 2013, 12:00 AM