CVSS: 5.5EPSS: 0%CPEs: 38EXPL: 0CVE-2010-2942 – kernel: net sched: fix some kernel memory leaks
https://notcve.org/view.php?id=CVE-2010-2942
The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c. La implementación de acciones en la funcionalidad de encolado de red en el kernel Linx anterior a v2.6.36-rc2 no inicializa apropiadamente ciertos miembros de estructura cuando se realizan acciones de volcado, lo que permite a usuarios locales obtener información potencialmente sensible de la memoria del kernel a través de vectores relacionados con (1) la funcion tcf_gact_dump en net/sched/act_gact.c, (2) la funcion tcf_mirred_dump en net/sched/act_mirred.c, (3) la funcion tcf_nat_dump en net/sched/act_nat.c, (4) la funcion tcf_simp_dump en net/sched/act_simple.c, y (5) la funcion tcf_skbedit_dump en net/sched/act_skbedit.c. • http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=1c40be12f7d8ca1d387510d39787b12e512a7ce8 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html http://patchwork.oz • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 17EXPL: 0CVE-2010-3078 – kernel: xfs: XFS_IOC_FSGETXATTR ioctl memory leak
https://notcve.org/view.php?id=CVE-2010-3078
The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call. La función xfs_ioc_fsgetxattr en fs/xfs/linux-2.6/xfs_ioctl.c del kernel Linux anterior a v2.6.36-rc4 no inicializa apropiadamente ciertos miembros de estructura, lo que permite a usuarios locales obtener información potencialmente sensible de la pila de memoria del kernel a través de una llamada ioctl. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html http://secunia.com/advisories/41284 http://secunia.com/advisories/41512 http://secunia • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 2CVE-2010-3081 – Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Local Privilege Escalation
https://notcve.org/view.php?id=CVE-2010-3081
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010. Las funciones compat_alloc_user_space en los ficheros include/asm/compat.h del kernel de Linux en versiones anteriores a la v2.6.36-rc4-git2 en plataformas de 64-bit no reservan adecuadamente la memoria del espacio de usuario requerida para la capa de compatibilidad de 32-bit, lo que permite a usuarios locales escalar privilegios basándose en la capacidad de la función compat_mc_getsockopt (también conocido como soporte MCAST_MSFILTER getsockopt) para controlar un valor de longitud determinado, relacionado con un "stack pointer underflow", como se ha demostrado en septiembre del 2010. • https://www.exploit-db.com/exploits/15024 http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html http://blog.ksplice.com/2010/09/cve-2010-3081 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c41d68a513c71e35a14f66d71782d27a79a81ea6 http://isc.sans.edu/diary.html?storyid=9574 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html http://lists.opensuse. • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2010-2524 – kernel: dns_resolver upcall security issue
https://notcve.org/view.php?id=CVE-2010-2524
The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals. La funcionalidad de resolución DNS en el kernel de Linux anterior a v2.6.35, cuando CONFIG_CIFS_DFS_UPCALL está activado, cuenta con el "keyring" de usuario para la "upcall" dns_resolver en el espacio de usuario cifs.upcall, lo que permite a usuarios locales secuestrar los resultados de las consultas DNS y realizar montajes (mounts) CIFS de su elección a través de vectores que involucran una llamada add_key, relacionado con un cuestión de relleno de caché (stuffing) y referencias MS-DFS. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4c0c03ca54f72fdd5912516ad0a23ec5cf01bda7 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html http://marc.info/?l=oss-security&m=128072090331700&w=2 http://marc.info/?l=oss-security&m=128078387328921&w=2 http://marc.info/?l=oss-security&m=128080755321157&w=2 http://secunia.com/advisories/43315 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35 http://www.mandr •
CVSS: 5.5EPSS: 0%CPEs: 12EXPL: 0CVE-2010-2066 – kernel: ext4: Make sure the MOVE_EXT ioctl can't overwrite append-only files
https://notcve.org/view.php?id=CVE-2010-2066
The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a MOVE_EXT ioctl call that specifies this file as a donor. La función mext_check_arguments en fs/ext4/move_extent.c en el kernel de Linux anterior a v2.6.35, permite a usuarios locales sobrescribir una archivo de solo-añadir (append-only) a través de una llamada MOVE_EXT ioctl que especifica este archivo como un donante. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1f5a81e41f8b1a782c68d3843e9ec1bfaadf7d72 http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00000.html http://secunia.com/advisories/43315 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35 http://www.openwall.com/lists/oss-security/2010/06/07/1 http://www.openwall.com/lists/oss-security/2010/06/09/1 http://www.redhat.com/support/errata/RHSA-2010-0610.html http://w •