CVE-2009-3556 in Red Hat
Summary
by MITRE
A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/29/2026
The vulnerability described in CVE-2009-3556 represents a critical privilege escalation flaw within the qla2xxx storage driver implementation in Red Hat Enterprise Linux 5 systems. This issue specifically affects environments utilizing N_Port ID Virtualization hardware capabilities where the kernel configuration process fails to properly secure sensitive system interfaces. The flaw manifests through improper file permission settings on two critical virtual port management files within the sysfs filesystem hierarchy, creating a significant security risk for local attackers who can exploit these misconfigurations to gain unauthorized control over SCSI host attributes.
The technical implementation of this vulnerability stems from the improper configuration of file permissions during the qla2xxx driver initialization process in kernel version 2.6.18. When NPIV hardware is present, the system creates two specific files named vport_create and vport_delete under the /sys/class/scsi_host/ directory path. These files are intended to control virtual port creation and deletion operations within the SCSI subsystem. However, due to a configuration oversight, these files are created with world-writable permissions instead of the appropriate restricted access controls. This misconfiguration allows any local user to modify these files directly, bypassing normal access controls and privilege boundaries that should normally prevent unauthorized modification of system-critical storage interfaces.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential system compromise and data integrity violations. Local attackers with minimal privileges can exploit these world-writable files to manipulate SCSI host attributes, potentially enabling them to create unauthorized virtual ports, delete legitimate ones, or modify host configuration parameters that could disrupt storage operations. This capability directly violates the principle of least privilege and could allow attackers to establish persistent access points within the storage subsystem, making it particularly dangerous in enterprise environments where storage security is paramount. The vulnerability affects systems running Red Hat Enterprise Linux 5 with NPIV hardware, representing a significant risk to organizations relying on Fibre Channel storage infrastructures.
Security mitigations for this vulnerability involve immediate remediation through proper file permission configuration and system updates. System administrators should ensure that the vport_create and vport_delete files under /sys/class/scsi_host/ maintain appropriate restricted permissions, typically requiring root access or specific SCSI subsystem privileges for modification. The recommended approach includes implementing proper kernel configuration during installation or applying the relevant Red Hat security patches that correct the permission settings. Additionally, organizations should conduct comprehensive audits of their storage subsystem configurations to identify any other similar permission misconfigurations that could provide similar attack vectors. This vulnerability aligns with CWE-732: Incorrect Permission Assignment for Critical Resource and relates to ATT&CK techniques involving privilege escalation and persistence through system interface manipulation. The issue demonstrates the critical importance of proper file system permissions in kernel-level subsystems and highlights the need for comprehensive security testing of device drivers and system interfaces during deployment phases.