CVE-2010-2524 — Kernel vulnerability

9 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 75.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Linux KernelCanonical Ubuntu LinuxSuse Linux Enterprise Desktop+2 more
Timeline
PublishedSep 8
Latest updateMay 13

Description

The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages4 packages

▶NVDlinux/linux_kernel< 2.6.35
▶NVDvmware/esx4.0, 4.1+1

Also affects: Ubuntu Linux 10.04, 10.10, 6.06, 8.04, 9.04, 9.10

Patches

Patch: marc.info ↗Patch: marc.info ↗Patch: www.vmware.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gh3w-mmv8-hhv4: The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2↗2022-05-13
▶
CVEList
CVE-2010-2524: The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2↗2010-09-08
▶

📋Vendor Advisories

5
Ubuntu
Linux kernel vulnerabilities↗2011-03-03
▶
Ubuntu
Linux kernel vulnerabilities↗2011-02-28
▶
Ubuntu
Linux kernel vulnerabilities↗2011-02-25
▶
Ubuntu
Linux kernel vulnerabilities↗2010-10-19
▶
Red Hat
kernel: dns_resolver upcall security issue↗2010-07-22
▶

💬Community

1
Bugzilla
CVE-2010-2524 kernel: dns_resolver upcall security issue↗2010-07-07
▶
CVE-2010-2524 — Linux Kernel vulnerability | cvebase