CVE-2010-2537
published 2010-09-30CVE-2010-2537: The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1)…
PriorityP423high7.1CVSS 3.1
AVLACLPRLUINSUCNIHAH
EPSS
0.39%
31.6th percentile
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| linux | linux_kernel | < 2.6.35 | 2.6.35 |
| suse | linux_enterprise_high_availability_extension | — | — |
| suse | suse_linux_enterprise_desktop | — | — |
| suse | suse_linux_enterprise_server | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvdv2.06.6MEDIUMAV:L/AC:L/Au:N/C:N/I:C/A:C
vendor_redhat7.1HIGH
vendor_ubuntu7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-01-10·CVSS 7.1
CVE-2010-3698 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple security flaws in Linux kernel.
Louis Rilling and Matthieu Fertré reported a use after free error in the
Linux kernel's futex_wait function. A local user could exploit this flaw to
cause a denial of service (system crash) or possibly gain privileges via a
specially crafted application. (CVE-2014-0205)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Dan Rosenberg discovered that the btrfs filesystem did not correctly
validate permissions when using the clone function. A local attacker could
overwrite the contents of file handles that were o
Red Hat
kernel: btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
vendor_redhat·CVSS 7.1
CVE-2010-2537 [HIGH] kernel: btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
kernel: btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.
GHSA
GHSA-2whq-7q65-c6wv: The btrfs_ioctl_clone function in fs/btrfs/ioctl
ghsa_unreviewed·2022-05-13
CVE-2010-2537 [HIGH] GHSA-2whq-7q65-c6wv: The btrfs_ioctl_clone function in fs/btrfs/ioctl
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-2537 CVE-2010-2538 kernel: btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
bugzilla·2010-07-21·CVSS 7.1
CVE-2010-2537 [HIGH] CVE-2010-2537 CVE-2010-2538 kernel: btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
CVE-2010-2537 CVE-2010-2538 kernel: btrfs: fix checks in BTRFS_IOC_CLONE_RANGE
Description of problem:
1. CVE-2010-2537 - The BTRFS_IOC_CLONE and BTRFS_IOC_CLONE_RANGE ioctls should check whether the donor file is append-only before writing to it.
2. CVE-2010-2538 - The BTRFS_IOC_CLONE_RANGE ioctl appears to have an integer
overflow that allows a user to specify an out-of-bounds range to copy from the source file (if off + len wraps around).
Upstream commit:
http://git.kernel.org/linus/2ebc3464781ad24474abcbd2274e6254689853b5
Reference:
https://btrfs.wiki.kernel.org/index.php/Main_Page
The kernel in Red Hat Enterprise Linux 6 has support for Btrfs by default.
Discussion:
Statement:
Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterp
Bugzilla
CVE-2010-2537 kernel: btrfs: check for append only file in the clone ioctl
bugzilla·2010-07-21·CVSS 7.1
CVE-2010-2537 [HIGH] CVE-2010-2537 kernel: btrfs: check for append only file in the clone ioctl
CVE-2010-2537 kernel: btrfs: check for append only file in the clone ioctl
Description of problem:
The existing [btrfs] code would have allowed you to overwrite append-only files. Not an expected behaviour.
Upstream commit:
http://git.kernel.org/linus/2ebc3464781ad24474abcbd2274e6254689853b5
Reference:
https://btrfs.wiki.kernel.org/index.php/Main_Page
The kernel in Red Hat Enterprise Linux 6 has support for Btrfs by default.
Discussion:
Statement:
Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5 and Red Hat Enterprise MRG as they did not include support for Btrfs, a new copy on write filesystem.
---
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for responsibly reporting this issue.
---
*** This
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e6254689853b5http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.htmlhttp://secunia.com/advisories/42758http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35http://www.openwall.com/lists/oss-security/2010/07/21/10http://www.openwall.com/lists/oss-security/2010/07/21/4http://www.securityfocus.com/bid/41847http://www.ubuntu.com/usn/USN-1041-1http://www.vupen.com/english/advisories/2011/0070https://bugzilla.redhat.com/show_bug.cgi?id=616998http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e6254689853b5http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.htmlhttp://secunia.com/advisories/42758http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35http://www.openwall.com/lists/oss-security/2010/07/21/10http://www.openwall.com/lists/oss-security/2010/07/21/4http://www.securityfocus.com/bid/41847http://www.ubuntu.com/usn/USN-1041-1http://www.vupen.com/english/advisories/2011/0070https://bugzilla.redhat.com/show_bug.cgi?id=616998
2010-09-30
Published