Every CVESearch/Get API key

CVE-2009-4307

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows...

7.1 High

CVE-2009-4307 is a high vulnerability (CVSS 7.1) in Linux Kernel, published December 13, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.43%, the 89th percentile. No source names a fixed version.

What does this mean?
Severity
7.1 HighCVSS 2.0, NVD
Exploit chance
3.43%EPSS, 89th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

Exploit likelihood

3.43%Up 1.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
linux-2.6
Debian:6.0
From an advisory covering 7 CVEs
before 2.6.32-41squeeze2, plus listed versions
2.6.32-302.6.32-30+m68k.52.6.32-312.6.32-31~bpo50+12.6.32-32
Show 14 moreShow less
2.6.32-332.6.32-342.6.32-34squeeze12.6.32-352.6.32-35squeeze12.6.32-35squeeze22.6.32-35~bpo50+12.6.32-362.6.32-372.6.32-382.6.32-392.6.32-39squeeze12.6.32-402.6.32-41
2.6.32-41squeeze2
kernel
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-PAE
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-PAE-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-PAE-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debug
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debug-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debug-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debuginfo-common
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
Show 39 moreShow less
Affected packages
PackageAffectedFixed
kernel-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-doc
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-xen
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-xen-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-xen-devel
Red Hat:enterprise_linux:5::client
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-PAE
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-PAE-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-PAE-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debug
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debug-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debug-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-debuginfo-common
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-doc
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-kdump
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-kdump-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-kdump-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-xen
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-xen-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel-xen-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 4 CVEs
before 0:2.6.18-194.el5
0:2.6.18-194.el5
kernel
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-PAE
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-PAE-debuginfo
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-PAE-devel
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-debug
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-debug-debuginfo
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-debug-devel
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-debuginfo
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-debuginfo-common
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-devel
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-doc
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-kdump
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-kdump-debuginfo
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-kdump-devel
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-xen
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-xen-debuginfo
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5
kernel-xen-devel
Red Hat:rhel_eus:5.4
From an advisory covering 4 CVEs
before 0:2.6.18-164.17.1.el5
0:2.6.18-164.17.1.el5

What each source reports

NVD Score used7.1

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

Record
CVE-2009-4307
CVSS 2.0
7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness
CWE-189
Updated
2026-11-02
CVE ListNo score

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

Record
CVE-2009-4307
Updated
2026-11-02
EUVDEUVD-2009-4275No score

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

Record
EUVD-2009-4275
Updated
2026-11-03
GitHub AdvisoriesGHSA-w39x-wg96-vcgwNo score

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows...

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).

Record
GHSA-w39x-wg96-vcgw
Updated
2026-11-02
OSVBELL-CVE-2009-43077.1

CVE-2009-4307 does not affect BellSoft software

Record
BELL-CVE-2009-4307
CVSS 2.0
7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 103 references. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open