PT-2011-1107 · Linux+1 · Linux Kernel+1
Alan Cox
·
Published
2011-01-04
·
Updated
2018-10-10
·
CVE-2010-4242
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel version 2.6.36
Linux kernel versions 2.6.9
Description
The issue is related to the Linux kernel, specifically the HCI UART driver, where the hci uart tty open function does not verify whether the tty has a write operation. This allows local users to cause a denial of service via vectors related to the Bluetooth driver. Additionally, multiple vulnerabilities have been identified in various Linux kernel packages, including kernel-devel, kernel-doc, kernel-hugemem, kernel-largesmp, and kernel-smp, which can lead to confidentiality, integrity, and availability breaches. These vulnerabilities can be exploited remotely.
Recommendations
For Linux kernel version 2.6.36, consider disabling the hci uart tty open function as a temporary workaround until a patch is available.
For Linux kernel versions 2.6.9, restrict access to the vulnerable kernel packages to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Memory Corruption
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux Kernel
Red Hat