PT-2011-1468 · Linux · Linux Kernel

Published 2011-01-11 · Updated 2017-08-17 · CVE-2010-4175

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel version 2.6.35

Description The issue is caused by an integer overflow in the rds cmsg rdma args function, allowing local users to cause a denial of service, potentially leading to a crash, and possibly triggering memory corruption via a crafted Reliable Datagram Sockets (RDS) request.

Recommendations For Linux kernel version 2.6.35, consider upgrading to a newer version that includes a fix for this issue, as using an outdated version poses a significant risk. As a temporary workaround, consider restricting access to the rds cmsg rdma args function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-4175

Affected Products

Linux Kernel

References · 16

• http://openwall.com/lists/oss-security/2010/11/18/1 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2010/11/17/8 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html · Vendor Advisory
• http://marc.info/?l=linux-netdev&m=129001184803080&w=2 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4175 · Security Note
• http://vupen.com/english/advisories/2011/0298 · Note
• http://secunia.com/advisories/42778 · Note
• http://vupen.com/english/advisories/2011/0012 · Note
• http://vupen.com/english/advisories/2011/0124 · Note
• http://securityfocus.com/bid/44921 · Note
• http://secunia.com/advisories/42932 · Note
• http://secunia.com/advisories/42801 · Note