CVE-2009-3889 — kernel: megaraid_sas permissions in sysfs

Back Back to CVE browser

MEDIUM

kernel: megaraid_sas permissions in sysfs

Published Nov 16, 2009

6.6

MEDIUM

CVSS 2.0

EPSS 0.53%

Description

The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file.

Affected products

MRG for RHEL-5

kernel-rt-0:2.6.24.7-139.el5rt

Fixed · RHSA-2009:1635
Red Hat Enterprise Linux 4

kernel-0:2.6.9-89.0.20.EL

Fixed · RHSA-2010:0076
Red Hat Enterprise Linux 5

kernel-0:2.6.18-164.11.1.el5

Fixed · RHSA-2010:0046

Product	Package	State	Advisory
MRG for RHEL-5	kernel-rt-0:2.6.24.7-139.el5rt	Fixed	RHSA-2009:1635
Red Hat Enterprise Linux 4	kernel-0:2.6.9-89.0.20.EL	Fixed	RHSA-2010:0076
Red Hat Enterprise Linux 5	kernel-0:2.6.18-164.11.1.el5	Fixed	RHSA-2010:0046

Remediation

Red Hat statement

This issue did not affect the version of the Linux kernel as shipped with Red Hat Enterprise Linux 3, as it does not implement the sysfs file system ("/sys/"), through which dbg_lvl file is exposed by the megaraid_sas driver.

Metrics

0.53% 0.00531

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00531

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.53% (0.00531)	42.77th	v5 (v2026.06.15)
Jun 15, 2026	0.53% (0.00531)	40.41th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00046)	11.23th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00044)	11.89th	v3 (v2023.03.01)
Jul 2, 2024	0.04% (0.00044)	10.25th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00044)	8.24th	v3 (v2023.03.01)
Mar 6, 2023	1.55% (0.01547)	74.98th	v2 (v2022.01.01)
Feb 23, 2023	1.55% (0.01547)	74.94th	v2 (v2022.01.01)
Apr 1, 2022	1.55% (0.01547)	72.92th	v2 (v2022.01.01)
Feb 4, 2022	1.55% (0.01547)	51.82th	v2 (v2022.01.01)

Weaknesses (1)

CWE-264

References (21)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=66dca9b8c50b5e59d3bea8b21cee5c6dae6c9c46
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html
vendor-advisoryx_refsource_SUSE
http://osvdb.org/60202
vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/37909
third-party-advisoryx_refsource_SECUNIA
http://support.avaya.com/css/P8/documents/100073666
x_refsource_CONFIRM
http://www.debian.org/security/2010/dsa-2005
vendor-advisoryx_refsource_DEBIAN
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27
x_refsource_CONFIRMVendor Advisory
http://www.openwall.com/lists/oss-security/2009/11/13/1
mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2009/11/13/4
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/37019
vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/usn-864-1
vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2009-3889
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=526068
x_refsource_MISCExploitIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2009-3889
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11018
vdb-entrysignaturex_refsource_OVAL
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7163
vdb-entrysignaturex_refsource_OVAL
https://rhn.redhat.com/errata/RHSA-2010-0046.html
vendor-advisoryx_refsource_REDHAT
https://rhn.redhat.com/errata/RHSA-2010-0095.html
vendor-advisoryx_refsource_REDHAT
https://www.cve.org/CVERecord?id=CVE-2009-3889

Link	Providers	Tags
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=66dca9b8c50b5e59d3bea8b21cee5c6dae6c9c46		x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html		vendor-advisoryx_refsource_SUSE
http://osvdb.org/60202		vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/37909		third-party-advisoryx_refsource_SECUNIA
http://support.avaya.com/css/P8/documents/100073666		x_refsource_CONFIRM
http://www.debian.org/security/2010/dsa-2005		vendor-advisoryx_refsource_DEBIAN
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27		x_refsource_CONFIRMVendor Advisory
http://www.openwall.com/lists/oss-security/2009/11/13/1		mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2009/11/13/4		mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/37019		vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/usn-864-1		vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2009-3889		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=526068		x_refsource_MISCExploitIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2009-3889
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11018		vdb-entrysignaturex_refsource_OVAL
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7163		vdb-entrysignaturex_refsource_OVAL
https://rhn.redhat.com/errata/RHSA-2010-0046.html		vendor-advisoryx_refsource_REDHAT
https://rhn.redhat.com/errata/RHSA-2010-0095.html		vendor-advisoryx_refsource_REDHAT
https://www.cve.org/CVERecord?id=CVE-2009-3889

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published Nov 16, 2009

Updated Aug 7, 2024

Reserved Nov 5, 2009

Link CVE-2009-3889

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2009-3889

Red Hat

Severity Moderate

Public date Sep 28, 2009

Links CVE-2009-3889 - Bugzilla