PT-2017-4907 · Linux · Linux Kernel

Mathias Krause · Published 2017-02-06 · Updated 2017-03-29 · CVE-2010-5328

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.35

Description: The issue allows local users to cause a denial of service, resulting in a system crash, by sending signals with a process group ID of zero to the swapper process. This is possible because the Linux kernel before version 2.6.35 does not prevent such signals from reaching the swapper process.

Recommendations: For Linux kernel versions prior to 2.6.35, update to version 2.6.35 or later to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-5328

Affected Products

Linux Kernel

References · 15

• https://github.com/torvalds/linux/commit/fa2755e20ab0c7215d99c2dc7c262e98a09b01df · Patch
• https://github.com/torvalds/linux/commit/f20011457f41c11edb5ea5038ad0c8ea9f392023 · Patch
• https://github.com/torvalds/linux/commit/f106eee10038c2ee5b6056aaf3f6d5229be6dcdd · Patch
• http://openwall.com/lists/oss-security/2017/01/21/2 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2010-5328 · Vendor Advisory
• https://ubuntu.com/security/CVE-2010-5328 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa2755e20ab0c7215d99c2dc7c262e98a09b01df · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2010-5328 · Security Note
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f20011457f41c11edb5ea5038ad0c8ea9f392023 · Patch
• https://cve.org/CVERecord?id=CVE-2010-5328 · Security Note
• http://ftp.naist.jp/pub/linux/kernel/v2.6/ChangeLog-2.6.35 · Vendor Advisory
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f106eee10038c2ee5b6056aaf3f6d5229be6dcdd · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1358840 · Patch
• http://securityfocus.com/bid/97103 · Note
• http://seclists.org/oss-sec/2017/q1/160 · Note