PT-2010-5685 · Linux+1 · Linux Kernel+1
Dan Rosenberg
·
Published
1970-01-01
·
Updated
2020-08-14
·
CVE-2010-4083
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 2.6.36
kernel-kdumppae-debuginfo (affected versions not specified)
kernel-devel-2.6.9
kernel-doc-2.6.9
kernel-vmipae-debuginfo (affected versions not specified)
kernel-hugemem-2.6.9
kernel-2.6.9
kernel-largesmp-2.6.9
kernel-smp-devel-2.6.9
kernel-smp-2.6.9
kernel-hugemem-devel-2.6.9
kernel-largesmp-devel-2.6.9
Description
The issue is related to multiple vulnerabilities in the Linux kernel, which can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The
copy semid to user function in ipc/sem.c does not initialize a certain structure, allowing local users to obtain potentially sensitive information from kernel stack memory via certain commands in a semctl system call.Recommendations
For Linux kernel versions prior to 2.6.36, update to version 2.6.36 or later.
For kernel-kdumppae-debuginfo, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For kernel-devel-2.6.9, kernel-doc-2.6.9, kernel-vmipae-debuginfo, kernel-hugemem-2.6.9, kernel-2.6.9, kernel-largesmp-2.6.9, kernel-smp-devel-2.6.9, kernel-smp-2.6.9, kernel-hugemem-devel-2.6.9, kernel-largesmp-devel-2.6.9, consider disabling the
copy semid to user function as a temporary workaround until a patch is available.
As a general mitigation measure, restrict access to the vulnerable kernel modules to minimize the risk of exploitation.Memory Corruption
Information Disclosure
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Red Hat