Description
The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.
References (18)
Scores
EPSS
0.0009
EPSS Percentile
26.2%
Details
CWE
CWE-193
Status
published
Products (12)
canonical/ubuntu_linux
6.06
canonical/ubuntu_linux
8.04
canonical/ubuntu_linux
9.04
canonical/ubuntu_linux
9.10
canonical/ubuntu_linux
10.04
canonical/ubuntu_linux
10.10
linux/linux_kernel
2.6.36 (3 CPE variants)
linux/linux_kernel
< 2.6.36
opensuse/opensuse
11.1
suse/linux_enterprise_desktop
11
... and 2 more
Published
Sep 08, 2010
Tracked Since
Feb 18, 2026