PT-2010-5117 · Linux+1 · Linux Kernel+1

Nelson Elhage · Published 2010-12-30 · Updated 2023-02-13 · CVE-2010-3848

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.36.2

Description A stack-based buffer overflow issue exists in the econet sendmsg function, located in net/econet/af econet.c. This issue can be exploited by local users when an econet address is configured, allowing them to gain privileges by providing a large number of iovec structures.

Recommendations For versions prior to 2.6.36.2, update to version 2.6.36.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the econet sendmsg function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2010-3848

DSA-2126-1

Affected Products

Linux Kernel

Suse

References · 17

• 🔥 https://exploit-db.com/exploits/17787 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/11/30/1 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2010:257 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html · Vendor Advisory
• http://debian.org/security/2010/dsa-2126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3848 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=644156 · Patch
• http://ubuntu.com/usn/USN-1023-1 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0298 · Note
• http://vupen.com/english/advisories/2011/0375 · Note
• http://secunia.com/advisories/43056 · Note
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2 · Note
• http://secunia.com/advisories/43291 · Note