CVE-2009-4005 — kernel: isdn: hfc_usb: fix read buffer overflow

Back Back to CVE browser

HIGH

kernel: isdn: hfc_usb: fix read buffer overflow

Published Nov 20, 2009

7.2

HIGH

CVSS 2.0

EPSS 0.42%

Description

The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the Linux kernel before 2.6.32-rc7 allows attackers to have an unspecified impact via a crafted HDLC packet that arrives over ISDN and triggers a buffer under-read.

Affected products

Product	Package	State	Advisory
Red Hat Enterprise Linux 4	kernel-0:2.6.9-89.0.20.EL	Fixed	RHSA-2010:0076

Remediation

Red Hat statement

The Linux kernel as shipped with Red Hat Enterprise Linux 3, 5, and Red Hat Enterprise MRG did not include support for the HiSax ISDN driver for Colognechip HFC-S USB chip, and therefore were not affected by this issue.

Metrics

0.42% 0.00420

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00420

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.42% (0.00420)	34.08th	v5 (v2026.06.15)
Jun 15, 2026	0.42% (0.00420)	33.34th	v5 (v2026.06.15)
Mar 17, 2025	0.05% (0.00054)	14.05th	v4 (v2025.03.14)
Dec 12, 2024	0.06% (0.00064)	30.08th	v3 (v2023.03.01)
Jun 21, 2024	0.06% (0.00064)	28.17th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00064)	26.16th	v3 (v2023.03.01)
Mar 6, 2023	1.55% (0.01547)	74.98th	v2 (v2022.01.01)
Feb 23, 2023	1.55% (0.01547)	74.94th	v2 (v2022.01.01)
Apr 1, 2022	1.55% (0.01547)	72.92th	v2 (v2022.01.01)
Feb 4, 2022	1.55% (0.01547)	51.82th	v2 (v2022.01.01)

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-125

Out-of-bounds Read

References (23)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=286e633ef0ff5bb63c07b4516665da8004966fec
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html
vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/37720
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/37909
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/38017
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/38276
third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2010/dsa-2005
vendor-advisoryx_refsource_DEBIAN
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc7
x_refsource_CONFIRMVendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:030
vendor-advisoryx_refsource_MANDRIVA
http://www.securityfocus.com/bid/37036
vdb-entryx_refsource_BIDPatch
http://www.ubuntu.com/usn/usn-864-1
vendor-advisoryx_refsource_UBUNTU
http://www.vupen.com/english/advisories/2009/3267
vdb-entryx_refsource_VUPENPatchVendor Advisory
https://access.redhat.com/security/cve/CVE-2009-4005
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=539435
Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/54310
vdb-entryx_refsource_XF
https://nvd.nist.gov/vuln/detail/CVE-2009-4005
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11155
vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2009-4005
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00777.html
vendor-advisoryx_refsource_FEDORA

Link	Providers	Tags
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=286e633ef0ff5bb63c07b4516665da8004966fec		x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00002.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00005.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00007.html		vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/37720		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/37909		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/38017		third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/38276		third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2010/dsa-2005		vendor-advisoryx_refsource_DEBIAN
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.32-rc7		x_refsource_CONFIRMVendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:030		vendor-advisoryx_refsource_MANDRIVA
http://www.securityfocus.com/bid/37036		vdb-entryx_refsource_BIDPatch
http://www.ubuntu.com/usn/usn-864-1		vendor-advisoryx_refsource_UBUNTU
http://www.vupen.com/english/advisories/2009/3267		vdb-entryx_refsource_VUPENPatchVendor Advisory
https://access.redhat.com/security/cve/CVE-2009-4005		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=539435		Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/54310		vdb-entryx_refsource_XF
https://nvd.nist.gov/vuln/detail/CVE-2009-4005
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11155		vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2009-4005
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00777.html		vendor-advisoryx_refsource_FEDORA