CVE-2007-6716
Publication date 4 September 2008
Last updated 25 August 2025
Ubuntu priority
Description
fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as demonstrated by a certain fio test.
From the Ubuntu Security Team
It was discovered that the direct-IO subsystem did not correctly validate certain structures. A local attacker could exploit this to cause a system crash, leading to a denial of service.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| linux | ||
| linux-source-2.6.15 | ||
| linux-source-2.6.20 | ||
| linux-source-2.6.22 | ||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
5.5 · Medium
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |