CVE-2009-3620

Publication date 22 October 2009

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	9.10 karmic	Fixed 2.6.31-16.52
	9.04 jaunty	Fixed 2.6.28-17.58
	8.10 intrepid	Fixed 2.6.27-16.44
	8.04 LTS hardy	Fixed 2.6.24-26.64
	6.06 LTS dapper	Not in release
linux-source-2.6.15	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Fixed 2.6.15-55.81

Severity score breakdown

Parameter	Value
Base score	7.8 · High
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2009-3620

Cvss 3 Severity Score

Description

Status

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references