CVE-2009-1072 describes a privilege escalation vulnerability in the nfsd component of the Linux kernel before version 2.6.28.9, affecting various distributions including Canonical, Debian, Red Hat, and SUSE. This flaw allows local users to create device nodes on NFS-exported filesystems, even when root_squash is enabled, due to nfsd failing to drop the CAP_MKNOD capability. With a CVSS score of 4.9, it is a low-severity vulnerability requiring local access with low attack complexity, primarily impacting integrity. There is no evidence of active exploitation, no public exploit code available (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.6.28.9CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
10.3CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:* | ||
11.0CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:* | ||
11.1CPE matchmatch criteria | cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:* | ||
10CPE matchmatch criteria | cpe:2.3:o:suse:linux_enterprise_desktop:10:sp2:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:L/Au:N/C:N/I:C/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.