CVE-2010-3081

Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Local Privilege Escalation

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

Las funciones compat_alloc_user_space en los ficheros include/asm/compat.h del kernel de Linux en versiones anteriores a la v2.6.36-rc4-git2 en plataformas de 64-bit no reservan adecuadamente la memoria del espacio de usuario requerida para la capa de compatibilidad de 32-bit, lo que permite a usuarios locales escalar privilegios basándose en la capacidad de la función compat_mc_getsockopt (también conocido como soporte MCAST_MSFILTER getsockopt) para controlar un valor de longitud determinado, relacionado con un "stack pointer underflow", como se ha demostrado en septiembre del 2010.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-08-20 CVE Reserved
2010-09-16 CVE Published
2010-09-16 First Exploit
2023-03-08 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

CAPEC

References (30)

URL	Tag	Source
http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html	Broken Link
http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html	Broken Link
http://blog.ksplice.com/2010/09/cve-2010-3081	Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c41d68a513c71e35a14f66d71782d27a79a81ea6	X_refsource_confirm
http://secunia.com/advisories/42384	Broken Link
http://secunia.com/advisories/43315	Broken Link
http://sota.gen.nz/compat1	Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.log	Broken Link
http://www.securityfocus.com/archive/1/514938/30/30/threaded	Mailing List
http://www.securityfocus.com/archive/1/516397/100/0/threaded	Mailing List
http://www.vmware.com/security/advisories/VMSA-2010-0017.html	Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2011-0003.html	Third Party Advisory
http://www.vupen.com/english/advisories/2010/3083	Broken Link
http://www.vupen.com/english/advisories/2010/3117	Broken Link
http://www.vupen.com/english/advisories/2011/0298	Broken Link

URL	Date	SRC
https://www.exploit-db.com/exploits/15024	2010-09-16
https://access.redhat.com/kb/docs/DOC-40265	2024-08-07

URL	Date	SRC
http://isc.sans.edu/diary.html?storyid=9574	2023-02-13
http://marc.info/?l=oss-security&m=128461522230211&w=2	2023-02-13
https://bugzilla.redhat.com/show_bug.cgi?id=634457	2010-11-12

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html	2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html	2023-02-13
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:214	2023-02-13
http://www.mandriva.com/security/advisories?name=MDVSA-2010:247	2023-02-13
http://www.redhat.com/support/errata/RHSA-2010-0758.html	2023-02-13
http://www.redhat.com/support/errata/RHSA-2010-0842.html	2023-02-13
http://www.redhat.com/support/errata/RHSA-2010-0882.html	2023-02-13
https://access.redhat.com/security/cve/CVE-2010-3081	2010-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				<= 2.6.35.4 Search vendor "Linux" for product "Linux Kernel" and version " <= 2.6.35.4"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				2.6.36 Search vendor "Linux" for product "Linux Kernel" and version "2.6.36"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				2.6.36 Search vendor "Linux" for product "Linux Kernel" and version "2.6.36"		rc1		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				2.6.36 Search vendor "Linux" for product "Linux Kernel" and version "2.6.36"		rc2		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				2.6.36 Search vendor "Linux" for product "Linux Kernel" and version "2.6.36"		rc3		Affected
Vmware Search vendor "Vmware"		Esx Search vendor "Vmware" for product "Esx"				4.0 Search vendor "Vmware" for product "Esx" and version "4.0"		-		Affected
Vmware Search vendor "Vmware"		Esx Search vendor "Vmware" for product "Esx"				4.1 Search vendor "Vmware" for product "Esx" and version "4.1"		-		Affected
Suse Search vendor "Suse"		Suse Linux Enterprise Desktop Search vendor "Suse" for product "Suse Linux Enterprise Desktop"				11 Search vendor "Suse" for product "Suse Linux Enterprise Desktop" and version "11"		sp1		Affected
Suse Search vendor "Suse"		Suse Linux Enterprise Server Search vendor "Suse" for product "Suse Linux Enterprise Server"				11 Search vendor "Suse" for product "Suse Linux Enterprise Server" and version "11"		sp1		Affected