PT-2010-4487 · Carnegie Mellon University · Coda Filesystem Kernel Module

Published 2010-08-20 · Updated 2018-10-10 · CVE-2010-3014

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Coda filesystem kernel module (affected versions not specified)

Description The issue allows local users to read sensitive heap memory. This is achieved by using a large out size value in a ViceIoctl struct to a Coda ioctl, which triggers a buffer over-read when Coda is loaded and Venus is running with /coda mounted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-3014

Affected Products

Coda Filesystem Kernel Module

References · 5

• http://cvsweb.netbsd.org/bsdweb.cgi/src/sys/coda/coda.h.diff?r1=1.15&r2=1.16&only_with_tag=MAIN · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-3014 · Security Note
• http://svn.freebsd.org/viewvc/base?view=revision&revision=210997 · Patch
• http://securityfocus.com/archive/1/513151/100/0/threaded · Note
• http://vsecurity.com/resources/advisory/20100816-1 · Note