TI-2008-02805 Aliases CVE-2008-2931 GHSA-qrf3-cqg5-vv53

The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not…

LOW 34CWE-269Published 2008-07-09 · Updated 2024-08-07

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Privilege escalation
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-269.

Summary

The do_change_type function in fs/namespace.c in the Linux kernel before 2.6.22 does not verify that the caller has the CAP_SYS_ADMIN capability, which allows local users to gain privileges or cause a denial of service by modifying the properties of a mountpoint.

Why it matters now

EPSS 0.00375 31st percentileScored 2026-11-07

Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	before 2.6.22	Vulnerable	Linux
cpe:2.3:o:debian:debian_linux:4.0:::::::*	4.0	Vulnerable	Debian
cpe:2.3:o:novell:suse_linux_enterprise_desktop:10.0:sp1::::::	10.0 sp1	Vulnerable	Novell
cpe:2.3:o:novell:suse_linux_enterprise_desktop:10.0:sp2::::::	10.0 sp2	Vulnerable	Novell
cpe:2.3:o:novell:suse_linux_enterprise_server:10.0:sp1::::::	10.0 sp1	Vulnerable	Novell
cpe:2.3:o:novell:suse_linux_enterprise_server:10.0:sp2::::::	10.0 sp2	Vulnerable	Novell
cpe:2.3:o:opensuse:opensuse::::::::	10.3 – 11.0	Vulnerable	openSUSE
cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::	6.06	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::*	7.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:7.10:::::::*	7.10	Vulnerable	Canonical

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 2.6.22 Vulnerable ·Linux
cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Debian
cpe:2.3:o:novell:suse_linux_enterprise_desktop:10.0:sp1:*:*:*:*:*:* Versions 10.0 sp1 Vulnerable ·Novell
cpe:2.3:o:novell:suse_linux_enterprise_desktop:10.0:sp2:*:*:*:*:*:* Versions 10.0 sp2 Vulnerable ·Novell
cpe:2.3:o:novell:suse_linux_enterprise_server:10.0:sp1:*:*:*:*:*:* Versions 10.0 sp1 Vulnerable ·Novell
cpe:2.3:o:novell:suse_linux_enterprise_server:10.0:sp2:*:*:*:*:*:* Versions 10.0 sp2 Vulnerable ·Novell
cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:* Versions 10.3 – 11.0 Vulnerable ·openSUSE
cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:* Versions 6.06 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:* Versions 7.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:* Versions 7.10 Vulnerable ·Canonical

Show 1 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:canonical:ubuntu_linux:8.04::::lts:::	8.04	Vulnerable	Canonical

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:* Versions 8.04 Vulnerable ·Canonical

Remediation

Red Hat 1 advisory

RHSA-2008:0885 Released 2008-09-24 · Red Hat rating Important
kernel security and bug fix update
- Red Hat Enterprise Linux (v. 5 server) kernel-2.6.18-92.1.13.el5, kernel-2.6.18-92.1.13.el5.ia64, kernel-PAE-2.6.18-92.1.13.el5 +18
- Red Hat Enterprise Linux Desktop (v. 5 client) kernel-2.6.18-92.1.13.el5, kernel-PAE-2.6.18-92.1.13.el5, kernel-PAE-devel-2.6.18-92.1.13.el5 +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux (v. 5 server)	Fixed	RHSA-2008:0885
Red Hat Enterprise Linux Desktop (v. 5 client)	Fixed	RHSA-2008:0885

Timeline

2026-10-02 Threatist record created from CVE-2008-2931
2026-10-03 Alias added: GHSA-qrf3-cqg5-vv53

References

Patch 2

Advisory 9

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences