PT-2010-5117 · Linux+1 · Linux Kernel+1

Nelson Elhage · Publicado 2010-12-30 · Atualizado 2023-02-13 · CVE-2010-3848

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.36.2

Description A stack-based buffer overflow issue exists in the econet sendmsg function, located in net/econet/af econet.c. This issue can be exploited by local users when an econet address is configured, allowing them to gain privileges by providing a large number of iovec structures.

Recommendations For versions prior to 2.6.36.2, update to version 2.6.36.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the econet sendmsg function until a patch is available.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2010-3848

DSA-2126-1

Produtos afetados

Linux Kernel

Suse

Referências · 17

• 🔥 https://exploit-db.com/exploits/17787 · Exploit
• http://vupen.com/english/advisories/2011/0298 · Nota
• http://vupen.com/english/advisories/2011/0375 · Nota
• http://secunia.com/advisories/43056 · Nota
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/11/30/1 · Correção
• http://mandriva.com/security/advisories?name=MDVSA-2010:257 · Aviso do Fabricante
• http://secunia.com/advisories/43291 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html · Aviso do Fabricante
• http://debian.org/security/2010/dsa-2126 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-3848 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=644156 · Correção
• http://vupen.com/english/advisories/2011/0213 · Nota