PT-2010-5429 · Linux+1 · Linux Kernel+1

Tavis Ormandy · Published 2010-12-22 · Updated 2023-02-13 · CVE-2010-4346

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.37-rc6

Description The issue is related to the install special mapping function in mm/mmap.c, which fails to make an expected security file mmap function call. This allows local users to bypass intended mmap min addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.

Recommendations For Linux kernel versions prior to 2.6.37-rc6, update to version 2.6.37-rc6 or later to resolve the issue.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2010-4346

DSA-2153-1

RHSA-2011:0330

RHSA-2011:0421

RHSA-2011:0429

RHSA-2011_0421

RHSA-2011_0429

Affected Products

Linux Kernel

Red Hat

References · 36

• http://openwall.com/lists/oss-security/2010/12/09/12 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-4346 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-2014.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/12/09/13 · Patch
• https://bdu.fstec.ru/vul/2015-04359 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=662189 · Patch
• http://openwall.com/lists/oss-security/2010/12/10/3 · Patch
• http://mandriva.com/security/advisories?name=MDVSA-2011:029 · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/12/10/2 · Patch
• https://linux.oracle.com/errata/ELSA-2011-0421.html · Vendor Advisory
• https://lkml.org/lkml/2010/12/9/222 · Patch
• https://bdu.fstec.ru/vul/2015-05302 · Security Note
• https://github.com/torvalds/linux/commit/0a54917c3fc295cb61f3fb52373c173fd3b69f48 · Note
• https://access.redhat.com/security/cve/CVE-2010-4526 · Note
• https://access.redhat.com/security/cve/CVE-2011-0716 · Note