PT-2010-5680 · Linux+1 · Linux Kernel+2

Dan Rosenberg · Published 1970-01-01 · Updated 2024-06-15 · CVE-2010-3310

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise kernel-vmipae-debuginfo versions (affected versions not specified) SUSE Linux Enterprise kernel-kdumppae-debuginfo versions (affected versions not specified) openSUSE drbd-kmp-default versions (affected versions not specified) Linux kernel versions prior to 2.6.36-rc5-next-20100923

Description The issue involves multiple vulnerabilities in various packages of SUSE Linux Enterprise and openSUSE operating systems, as well as the Linux kernel. These vulnerabilities can be exploited to disrupt the confidentiality, integrity, and availability of protected information. Exploitation can be carried out remotely in the case of kernel-vmipae-debuginfo and kernel-kdumppae-debuginfo packages, while the drbd-kmp-default package vulnerability can be exploited locally. The Linux kernel vulnerability is related to integer signedness errors in the net/rose/af rose.c file, allowing local users to cause a denial of service or possibly have other unspecified impacts via the rose getname function call, related to the rose bind and rose connect functions.

Recommendations For SUSE Linux Enterprise kernel-vmipae-debuginfo, consider restricting access to sensitive information until a patch is available. For SUSE Linux Enterprise kernel-kdumppae-debuginfo, restrict remote access to minimize the risk of exploitation. For openSUSE drbd-kmp-default, consider disabling the package temporarily to prevent local exploitation. For Linux kernel versions prior to 2.6.36-rc5-next-20100923, update to a version after 2.6.36-rc5-next-20100923 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for the SUSE Linux Enterprise kernel-vmipae-debuginfo, kernel-kdumppae-debuginfo, and openSUSE drbd-kmp-default vulnerabilities.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-189

Related Identifiers

BDU:2015-04589

BDU:2015-04590

BDU:2015-05302

CVE-2010-3310

DSA-2126-1

OPENSUSE-SU-2024:10128-1

Affected Products

Linux Kernel

Suse Linux Enterprise

Opensuse

References · 111

• http://kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.36-rc5-next-20100923.bz2 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04590 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10128-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3310 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05302 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:051 · Vendor Advisory
• http://debian.org/security/2010/dsa-2126 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04589 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:029 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1000-1 · Vendor Advisory