CVE-2010-1636
Linux Kernel 2.6.29-2.6.32 - Unauthorized Sensitive Information Exposure via btrfs_ioctl_clone
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-1636. PoCs published by Dan Rosenberg.
AI-analyzed exploit summary This exploit demonstrates a security-bypass vulnerability in the Linux Kernel's Btrfs filesystem implementation, allowing an attacker to clone a file opened only for writing, potentially leading to sensitive data exposure. The PoC uses the BTRFS_IOC_CLONE ioctl to clone the target file to an output file.
Description
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the btrfs functionality in the Linux kernel 2.6.29 through 2.6.32, and possibly other versions, does not ensure that a cloned file descriptor has been opened for reading, which allows local users to read sensitive information from a write-only file descriptor.
Exploits (1)
This exploit demonstrates a security-bypass vulnerability in the Linux Kernel's Btrfs filesystem implementation, allowing an attacker to clone a file opened only for writing, potentially leading to sensitive data exposure. The PoC uses the BTRFS_IOC_CLONE ioctl to clone the target file to an output file.