CVE-2010-2959
published 2010-09-08CVE-2010-2959: Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x…
PriorityP270high7.2CVSS 2.0
AVLACLAuNCCICAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.75%
89.8th percentile
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | < 2.6.27.53 | 2.6.27.53 |
| linux | linux_kernel | >= 2.6.32 < 2.6.32.21 | 2.6.32.21 |
| linux | linux_kernel | >= 2.6.34 < 2.6.34.6 | 2.6.34.6 |
| linux | linux_kernel | >= 2.6.35 < 2.6.35.4 | 2.6.35.4 |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_high_availability_extension | — | — |
| suse | linux_enterprise_real_time | — | — |
| suse | linux_enterprise_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploit technique: crafted RX_SETUP BCM op with nframes set to (UINT_MAX / CFSIZ) + (ALLOCATION / 16) + 1 to trigger integer overflow during kmalloc, followed by a second RX_SETUP to bypass E2BIG check and overwrite adjacent SLUB memory. ↗
- →Detect exploit reading /proc/kallsyms to resolve commit_creds and prepare_kernel_cred kernel symbols; non-root access to /proc/kallsyms by a process also holding a PF_CAN socket is highly suspicious. ↗
- →Detect exploit reading /proc/slabinfo to measure kmalloc-96 SLUB cache occupancy for heap grooming; combined with PF_CAN socket creation this is a strong exploit indicator. ↗
- →Detect exploit cleanup step: shell command iterating /proc/sysvipc/shm to remove all user-owned shmids via ipcrm before heap grooming; this pattern of bulk ipcrm execution from a non-root process is anomalous. ↗
- →Kernel module blacklisting of 'can' and 'can_bcm' in /etc/modprobe.d/blacklist.conf prevents unprivileged auto-loading of the vulnerable CAN BCM module, mitigating the attack surface. ↗
- ·The exploit fails on Fedora 13 with SELinux enabled (even in permissive mode) because SELinux's ipc_has_perm dereferences the ->security member of the smashed kern_ipc_perm, causing a NULL dereference instead of privilege escalation. ↗
- ·Red Hat Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG are not vulnerable because they do not include support for the CAN broadcast manager (BCM) protocol. ↗
- ·The CAN BCM module is only present in kernels from v2.6.25-rc1 onward (introduced in commit ffd980f9); earlier kernels are not affected. ↗
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Al Viro discovered a race condition in the TTY driver. A local attacker
could exploit this to crash the system, leading to a denial of service.
(CVE-2009-4895)
Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly
check file permissions. A local attacker could overwrite append-only files,
leading to potential data loss. (CVE-2010-2066)
Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly
check file permissions. A local attacker could exploit this to read from
write-only files, leading to a loss of privacy. (CVE-2010-2226)
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory
manager did not properly handle when applications grow stacks into adjacent
memory regi
Ubuntu
Linux kernel regression
vendor_ubuntu·2010-08-26·CVSS 7.2
CVE-2010-2240 [HIGH] Linux kernel regression
Title: Linux kernel regression
Summary: This update provides a fix for the Linux kernel when using Xen.
USN-974-1 fixed vulnerabilities in the Linux kernel. The fixes for
CVE-2010-2240 caused failures for Xen hosts. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory
manager did not properly handle when applications grow stacks into adjacent
memory regions. A local attacker could exploit this to gain control of
certain applications, potentially leading to privilege escalation, as
demonstrated in attacks against the X server. (CVE-2010-2240)
Kees Cook discovered that under certain situations the ioctl subsystem for
DRM did not properly sanitize its arguments. A local a
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2010-08-19·CVSS 7.2
CVE-2010-2240 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: The Linux kernel could be made to crash or run programs as root.
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory
manager did not properly handle when applications grow stacks into adjacent
memory regions. A local attacker could exploit this to gain control of
certain applications, potentially leading to privilege escalation, as
demonstrated in attacks against the X server. (CVE-2010-2240)
Kees Cook discovered that under certain situations the ioctl subsystem for
DRM did not properly sanitize its arguments. A local attacker could exploit
this to read previously freed kernel memory, leading to a loss of privacy.
(CVE-2010-2803)
Ben Hawkes discovered an integer overflow in the Controller Area Network
(CAN) subsystem
Red Hat
kernel: can: add limit for nframes and clean up signed/unsigned variables
vendor_redhat·2010-08-11·CVSS 7.2
CVE-2010-2959 [HIGH] CWE-190 kernel: can: add limit for nframes and clean up signed/unsigned variables
kernel: can: add limit for nframes and clean up signed/unsigned variables
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
Statement: Not vulnerable. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG as they did not include support for the broadcast manager (BCM) protocol.
GHSA
GHSA-jj3r-mg29-qjwq: Integer overflow in net/can/bcm
ghsa_unreviewed·2022-05-13
CVE-2010-2959 [HIGH] CWE-190 GHSA-jj3r-mg29-qjwq: Integer overflow in net/can/bcm
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
VulnCheck
Linux Kernel Integer Overflow or Wraparound
vulncheck·2010·CVSS 7.2
CVE-2010-2959 [HIGH] Linux Kernel Integer Overflow or Wraparound
Linux Kernel Integer Overflow or Wraparound
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://flare.io/learn/resources/blog/old-school-irc-new-victims-inside-the-newly-discovered-sshstalker-linux-botnet
Suricata
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2007-2959 [HIGH] ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer ASCII
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer ASCII"; flow:established,to_server; http.uri; content:"/manufacturer.php?"; nocase; content:"id_manufacturer="; nocase; content:"SELECT"; nocase; pcre:"/.+ASCII\(.+SELECT/i"; reference:cve,CVE-2007-2959; reference:url,www.securityfocus.com/bid/24223; classtype:web-application-attack; sid:2004105; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_09, mitre_tactic_id TA0001, mitre_tactic
Suricata
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2007-2959 [HIGH] ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UPDATE
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UPDATE"; flow:established,to_server; http.uri; content:"/manufacturer.php?"; nocase; content:"id_manufacturer="; nocase; content:"UPDATE"; nocase; pcre:"/.+UPDATE.+SET/i"; reference:cve,CVE-2007-2959; reference:url,www.securityfocus.com/bid/24223; classtype:web-application-attack; sid:2004106; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_09, mitre_tactic_id TA0001, mitre_tactic_n
Suricata
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2007-2959 [HIGH] ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer INSERT
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer INSERT"; flow:established,to_server; http.uri; content:"/manufacturer.php?"; nocase; content:"id_manufacturer="; nocase; content:"INSERT"; nocase; pcre:"/.+INSERT.+INTO/i"; reference:cve,CVE-2007-2959; reference:url,www.securityfocus.com/bid/24223; classtype:web-application-attack; sid:2004103; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_09, mitre_tactic_id TA0001, mitre_tactic_
Suricata
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-2959 [HIGH] ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UNION SELECT
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer UNION SELECT"; flow:established,to_server; http.uri; content:"/manufacturer.php?"; nocase; content:"id_manufacturer="; nocase; content:"UNION"; nocase; pcre:"/.+UNION\s+SELECT/i"; reference:cve,CVE-2007-2959; reference:url,www.securityfocus.com/bid/24223; classtype:web-application-attack; sid:2004102; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_09, mitre_tactic_id TA0001,
Suricata
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-2959 [HIGH] ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer SELECT
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer SELECT"; flow:established,to_server; http.uri; content:"/manufacturer.php?"; nocase; content:"id_manufacturer="; nocase; content:"SELECT"; nocase; pcre:"/.+SELECT.+FROM/i"; reference:cve,CVE-2007-2959; reference:url,www.securityfocus.com/bid/24223; classtype:web-application-attack; sid:2004101; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_09, mitre_tactic_id TA0001, mitre_tactic_
Suricata
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2007-2959 [HIGH] ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer DELETE
ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cpCommerce SQL Injection Attempt -- manufacturer.php id_manufacturer DELETE"; flow:established,to_server; http.uri; content:"/manufacturer.php?"; nocase; content:"id_manufacturer="; nocase; content:"DELETE"; nocase; pcre:"/.+DELETE.+FROM/i"; reference:cve,CVE-2007-2959; reference:url,www.securityfocus.com/bid/24223; classtype:web-application-attack; sid:2004104; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_09, mitre_tactic_id TA0001, mitre_tactic_
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b75c4973ce779520b9d1e392483207d6f842cdehttp://jon.oberheide.org/files/i-can-haz-modharden.chttp://lists.fedoraproject.org/pipermail/package-announce/2010-September/046947.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/41512http://www.debian.org/security/2010/dsa-2094http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.53http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.21http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34.6http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.4http://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.openwall.com/lists/oss-security/2010/08/20/2http://www.securityfocus.com/bid/42585http://www.vupen.com/english/advisories/2010/2430http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=625699http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b75c4973ce779520b9d1e392483207d6f842cdehttp://jon.oberheide.org/files/i-can-haz-modharden.chttp://lists.fedoraproject.org/pipermail/package-announce/2010-September/046947.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/41512http://www.debian.org/security/2010/dsa-2094http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.53http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.21http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34.6http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.4http://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.openwall.com/lists/oss-security/2010/08/20/2http://www.securityfocus.com/bid/42585http://www.vupen.com/english/advisories/2010/2430http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=625699
2010-09-08
Published
Exploited in the wild