PT-2010-5682 · Linux+1 · Linux Kernel+1
Published
1970-01-01
·
Updated
2020-08-14
·
CVE-2010-4072
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 2.6.37-rc1
kernel-kdumppae-debuginfo (affected versions not specified)
kernel-devel-2.6.9 (affected versions not specified)
kernel-doc-2.6.9 (affected versions not specified)
kernel-vmipae-debuginfo (affected versions not specified)
kernel-hugemem-2.6.9 (affected versions not specified)
kernel-2.6.9 (affected versions not specified)
kernel-largesmp-2.6.9 (affected versions not specified)
kernel-smp-devel-2.6.9 (affected versions not specified)
kernel-smp-2.6.9 (affected versions not specified)
kernel-hugemem-devel-2.6.9 (affected versions not specified)
kernel-largesmp-devel-2.6.9 (affected versions not specified)
Description
The issue is related to multiple vulnerabilities in the Linux kernel, which can be exploited remotely to disrupt the confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited through vectors related to the shmctl system call and the "old shm interface." The copy shmid to user function in ipc/shm.c does not initialize a certain structure, allowing local users to obtain potentially sensitive information from kernel stack memory.
Recommendations
As a temporary workaround, consider disabling the
copy shmid to user function until a patch is available.
Restrict access to the vulnerable kernel modules to minimize the risk of exploitation.
Avoid using the shmctl system call in the affected kernel versions until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Memory Corruption
Information Disclosure
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Red Hat