PT-2010-5691 · Suse+2 · Suse Linux Enterprise+2

Dan Rosenberg · Published 1970-01-01 · Updated 2026-02-10 · CVE-2010-3437

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise kernel-vmipae-debuginfo versions prior to 2.6.36-rc6 SUSE Linux Enterprise kernel-kdumppae-debuginfo versions prior to 2.6.36-rc6

Description The issue is related to multiple vulnerabilities in the Linux kernel, specifically an integer signedness error in the pkt find dev from minor function in drivers/block/pktcdvd.c. This error allows local users to obtain sensitive information from kernel memory or cause a denial of service via a crafted index value in a PKT CTRL CMD STATUS ioctl call. The vulnerabilities can be exploited remotely, potentially leading to a disruption of protected information.

Recommendations For SUSE Linux Enterprise kernel-vmipae-debuginfo versions prior to 2.6.36-rc6, update to version 2.6.36-rc6 or later to resolve the issue. For SUSE Linux Enterprise kernel-kdumppae-debuginfo versions prior to 2.6.36-rc6, update to version 2.6.36-rc6 or later to resolve the issue. As a temporary workaround, consider restricting access to the pktcdvd module to minimize the risk of exploitation.

Exploit

Fix

DoS

Information Disclosure

NULL Pointer Dereference

Weakness Enumeration

CWE-200

CWE-476

Related Identifiers

BDU:2015-04589

BDU:2015-04590

CVE-2010-3437

DSA-2126-1

ELSA-2011-0007

RHSA-2010:0842

RHSA-2010_0842

Affected Products

Linux Kernel

Red Hat

Suse Linux Enterprise

References · 30

• 🔥 http://jon.oberheide.org/files/cve-2010-3437.c · Exploit
• 🔥 https://exploit-db.com/exploits/15150 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=638085 · Exploit
• 🔥 http://exploit-db.com/exploits/15150 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3437 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04590 · Security Note
• http://debian.org/security/2010/dsa-2126 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04589 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2011:029 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:051 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2010-0842.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1000-1 · Vendor Advisory