CVSS: 6.9EPSS: 0%CPEs: 21EXPL: 0CVE-2010-3442 – kernel: prevent heap corruption in snd_ctl_new()
https://notcve.org/view.php?id=CVE-2010-3442
Multiple integer overflows in the snd_ctl_new function in sound/core/control.c in the Linux kernel before 2.6.36-rc5-next-20100929 allow local users to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a crafted (1) SNDRV_CTL_IOCTL_ELEM_ADD or (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. Múltiples desbordamientos de entero en la función snd_ctl_new de sound/core/control.c en el kernel de Linux en versiones anteriores a la 2.6.36-rc5-next-20100929. Permiten a usuarios locales provocar una denegación de servicio (corrupción de la memoria dinámica) o posiblemente provocar otros impactos sin especificar a través de una llamada ioctl (1) SNDRV_CTL_IOCTL_ELEM_ADD o (2) SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl call. • http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git%3Ba=commit%3Bh=5591bf07225523600450edd9e6ad258bb877b779 http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html http://list • CWE-190: Integer Overflow or Wraparound •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2010-3079 – kernel: ftrace NULL ptr deref
https://notcve.org/view.php?id=CVE-2010-3079
kernel/trace/ftrace.c in the Linux kernel before 2.6.35.5, when debugfs is enabled, does not properly handle interaction between mutex possession and llseek operations, which allows local users to cause a denial of service (NULL pointer dereference and outage of all function tracing files) via an lseek call on a file descriptor associated with the set_ftrace_filter file. kernel/trace/ftrace.c en el kernel Linux anterior a la versión 2.6.36-rc5, cuando está habilitado debugfs, no maneja adecuadamente la interacción entre la posesión mutex y operaciones llseek, lo que permite a usuarios locales provocar una denegación de servicio (interrupción de todas las funciones de rastreo de archivos) mediante una llamada lseek en un descriptor de fichero asociado con el fichero set_ftrace_filter. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9c55cb12c1c172e2d51e85fbb5a4796ca86b77e7 http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html http://secunia.com/advisories/42758 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.5 http://www.redhat.com/support/errata/RHSA-2010-0842.html http://www.securityfocus.com/bid/43684 http://www.ubuntu.c • CWE-476: NULL Pointer Dereference •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2010-2537
https://notcve.org/view.php?id=CVE-2010-2537
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor. La función btrfs_ioctl_clone en fs/btrfs/ioctl.c en el kernel Linux, en versiones anteriores a la 2.6.35, permite a usuarios locales sobreescribir un fichero de solo-añadir (append-only) mediante una llamada ioctl (1) BTRFS_IOC_CLONE o (2) BTRFS_IOC_CLONE_RANGE que especifique este fichero como un donante. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e6254689853b5 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html http://secunia.com/advisories/42758 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35 http://www.openwall.com/lists/oss-security/2010/07/21/10 http://www.openwall.com/lists/oss-security/2010/07/21/4 http://www.securityfocus.com/bid/41847 http://www.ubuntu.com/usn •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2010-2538
https://notcve.org/view.php?id=CVE-2010-2538
Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFS_IOC_CLONE_RANGE ioctl call. Desbordamiento de entero en la función btrfs_ioctl_clone en fs/btrfs/ioctl.c en el kernel Linux, en versiones anteriores a la 2.6.35, puede permitir a usuarios locales obtener información sensible mediante una llamada ioctl BTRFS_IOC_CLONE_RANGE. • http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e6254689853b5 http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html http://secunia.com/advisories/42758 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35 http://www.openwall.com/lists/oss-security/2010/07/21/10 http://www.openwall.com/lists/oss-security/2010/07/21/4 http://www.securityfocus.com/bid/41854 http://www.ubuntu.com/usn • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 16EXPL: 0CVE-2010-3296 – kernel: drivers/net/cxgb3/cxgb3_main.c reading uninitialized stack memory
https://notcve.org/view.php?id=CVE-2010-3296
The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call. La función cxgb_extension_ioctl en drivers/net/cxgb3/cxgb3_main.c en el kernel Linux anterior a la versión 2.6.36-rc5, no inicia adecuadamente un miembro de cierta estructura, lo que permite a usuarios locales obtener información potencialmente sensible de la pila de memoria del kernel mediante una llamada ioctl CHELSIO_GET_QSET_NUM. • http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=49c37c0334a9b85d30ab3d6b5d1acb05ef2ef6de http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html http://lkml.org/lkml/2010/9/11/170 http://secunia.com/advisories/41440 http://secunia.com/advisories/42758 http://secunia.com/advisories/42884 http:/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •