PT-2010-5275 · Linux+1 · Linux Kernel+1

Dan Rosenberg · Published 2010-11-29 · Updated 2020-08-10 · CVE-2010-4074

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.36-rc5

Description The issue concerns the USB subsystem in the Linux kernel, which does not properly initialize certain structure members. This allows local users to obtain potentially sensitive information from kernel stack memory. The issue is related to vectors involving TIOCGICOUNT ioctl calls, specifically affecting the mos7720 ioctl function in drivers/usb/serial/mos7720.c and the mos7840 ioctl function in drivers/usb/serial/mos7840.c.

Recommendations For Linux kernel versions prior to 2.6.36-rc5, update to version 2.6.36-rc5 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2010-4074

DSA-2126-1

RHSA-2010:0958

RHSA-2011:0007

RHSA-2011_0007

Affected Products

Linux Kernel

Red Hat

References · 87

• https://linux.oracle.com/errata/ELSA-2011-0007.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04590 · Security Note
• https://bdu.fstec.ru/vul/2015-04609 · Security Note
• http://openwall.com/lists/oss-security/2010/10/25/3 · Patch
• https://bdu.fstec.ru/vul/2015-06267 · Security Note
• https://bdu.fstec.ru/vul/2015-08636 · Security Note
• https://bdu.fstec.ru/vul/2015-06266 · Security Note
• https://bdu.fstec.ru/vul/2015-08632 · Security Note
• https://bdu.fstec.ru/vul/2015-06261 · Security Note
• https://bdu.fstec.ru/vul/2015-08638 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-4074 · Security Note
• https://bdu.fstec.ru/vul/2015-06270 · Security Note
• https://bdu.fstec.ru/vul/2015-05302 · Security Note
• http://lkml.org/lkml/2010/9/15/392 · Patch
• http://openwall.com/lists/oss-security/2010/10/07/1 · Patch