CVE-2010-1437

HIGH

Linux Kernel < 2.6.34 - Race Condition in Keyring Deletion

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2010-1437. PoCs published by Toshiyuki Okajima.

AI-analyzed exploit summary This exploit leverages a local memory-corruption vulnerability in the Linux kernel (CVE-2010-1437) by repeatedly calling 'keyctl session' to trigger a denial-of-service (DoS) condition. The PoC may also allow arbitrary code execution, though this is unconfirmed.

Description

Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Toshiyuki Okajima · textdoslinux
https://www.exploit-db.com/exploits/33886

This exploit leverages a local memory-corruption vulnerability in the Linux kernel (CVE-2010-1437) by repeatedly calling 'keyctl session' to trigger a denial-of-service (DoS) condition. The PoC may also allow arbitrary code execution, though this is unconfirmed.

Classification
Working Poc 90%
Attack Type
Dos
Complexity
Trivial
Reliability
Reliable
Target: Linux kernel 2.6.34-rc5
No auth needed
Prerequisites: Local access to the vulnerable system
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →

References (21)

Core 21
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2010/04/27/2
Mailing List mailing-list x_refsource_mlist
http://marc.info/?l=linux-kernel&m=127292492727029&w=2
Broken Link, Patch x_refsource_confirm
https://patchwork.kernel.org/patch/94664/
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/58254
Exploit, Mailing List mailing-list x_refsource_mlist
http://marc.info/?l=linux-kernel&m=127192182917857&w=2
Broken Link vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0474.html
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40645
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43315
Exploit, Mailing List mailing-list x_refsource_mlist
http://marc.info/?l=linux-kernel&m=127274294622730&w=2
Broken Link x_refsource_confirm
https://patchwork.kernel.org/patch/94038/
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2010/04/28/2
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/40218
Third Party Advisory x_refsource_confirm
http://www.vmware.com/security/advisories/VMSA-2011-0003.html
Exploit, Issue Tracking, Patch x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=585094
Mailing List vendor-advisory x_refsource_debian
http://www.debian.org/security/2010/dsa-2053
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/39719
Broken Link, Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/516397/100/0/threaded
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/39830
Broken Link vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1857

Scores

CVSS v3 7.0
EPSS 0.0066
EPSS Percentile 47.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-362 CWE-416
Status published
Products (7)
debian/debian_linux 5.0
linux/linux_kernel 2.6.34 rc1 (5 CPE variants)
linux/linux_kernel < 2.6.34
opensuse/opensuse 11.1
suse/linux_enterprise_desktop 11
suse/linux_enterprise_high_availability_extension 11
suse/linux_enterprise_server 11
Published May 07, 2010
Tracked Since Feb 18, 2026