CVE-2010-3078

MEDIUM

Linux <2.6.36-rc4 - Info Disclosure

Title source: llm

Description

The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.

References (23)

[Patch] http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

[Broken Link] http://secunia.com/advisories/41284

[Broken Link] http://secunia.com/advisories/41512

[Broken Link] http://secunia.com/advisories/42890

[Broken Link] http://secunia.com/advisories/46397

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1024418

[Broken Link] http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4

[Broken Link] http://www.linux.sgi.com/archives/xfs-masters/2010-09/msg00002.html

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2010/09/07/1

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2010/09/07/12

[Broken Link] http://www.redhat.com/support/errata/RHSA-2010-0839.html

[Broken Link] http://www.redhat.com/support/errata/RHSA-2011-0007.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/520102/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/43022

[Third Party Advisory] http://www.ubuntu.com/usn/USN-1000-1

[Third Party Advisory] http://www.vmware.com/security/advisories/VMSA-2011-0012.html

... and 3 more

Scores

CVSS v3 5.5

EPSS 0.0008

EPSS Percentile 24.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status draft

Affected Products (17)

linux/linux_kernel < 2.6.35.4

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

opensuse/opensuse

opensuse/opensuse

suse/suse_linux_enterprise_desktop

suse/suse_linux_enterprise_server

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

canonical/ubuntu_linux

... and 2 more

Timeline

Published Sep 21, 2010

Tracked Since Feb 18, 2026