CVE-2010-3081
published 2010-09-24CVE-2010-3081: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the…
PriorityP276high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
3.53%
87.9th percentile
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | <= 2.6.35.4 | — |
| linux | linux_kernel | — | — |
| suse | suse_linux_enterprise_desktop | — | — |
| suse | suse_linux_enterprise_server | — | — |
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esxi | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_vcenter_server | — | — |
| vmware | vmware_vsphere | — | — |
| vmware | vmware_workstation | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x51\x57\x53\x56\x48\x31\xc9\x48\x89\xf8\x48\x31\xf6\xbe\x41\x41\x41\x41\x3b\x30\x75\x1f\x3b\x70\x04\x75\x1a\x3b\x70\x08\x75\x15\x3b\x70\x0c\x75\x10\x48\x31\xdb\x89\x18\x89\x58\x04\x89\x58\x08\x89\x58\x0c\xeb\x11\x48\xff\xc0\x48\xff\xc1\x48\x81\xf9\x4c\x04\x00\x00\x74\x02\xeb\xcc\x5e\x5b\x5f\x59\xc3
bytes↗
\x53\x52\x57\x48\xbb\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd3\x50\x48\x89\xc7\x48\xbb\x42\x42\x42\x42\x42\x42\x42\x42\xff\xd3\x48\x31\xd2\x89\x50\x04\x89\x50\x14\x48\x89\xc7\x48\xbb\x43\x43\x43\x43\x43\x43\x43\x43\xff\xd3\x5f\x5f\x5a\x5b\xc3
bytes↗
\x57\x50\x65\x48\x8b\x3c\x25\x00\x00\x00\x00\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd0\x58\x5f
bytes↗
\x0f\x01\xf8\x65\x48\x8b\x3c\x25\x00\x00\x00\x00\x48\xb8\x41\x41\x41\x41\x41\x41\x41\x41\xff\xd0\x0f\x01\xf8
- →The exploit (Ac1dB1tCh3z) reads /proc/kallsyms to resolve kernel symbols at runtime; monitor for unprivileged processes opening /proc/kallsyms followed by multicast getsockopt (MCAST_MSFILTER) syscalls. ↗
- →The exploit attempts three privilege-escalation methods: FOPS (timer_list_fops), IDT vector overwrite, and LSM hook replacement. Look for in-memory modifications to these kernel structures post-exploitation. ↗
- →The exploit installs an in-memory backdoor that does not survive a reboot; use the Ksplice detection tool or check for kernel structure tampering before rebooting a potentially compromised host. ↗
- →The exploit targets the compat_mc_getsockopt / MCAST_MSFILTER getsockopt path on 64-bit kernels with 32-bit compatibility enabled; alert on 32-bit processes issuing MCAST_MSFILTER getsockopt on 64-bit systems. ↗
- →Workaround: disabling 32-bit ELF support via binfmt_misc prevents exploitation; absence of this mitigation on unpatched kernels increases risk. ↗
- →The exploit accesses /proc/timer_list (timer_list_fops) as part of the FOPS exploitation method; monitor for unexpected access to /proc/timer_list by non-root processes. ↗
- →The exploit checks and attempts to disable SELinux enforcement by writing to /selinux/enforce; alert on writes to /selinux/enforce from non-administrative processes. ↗
- →The exploit maps memory at address 0x3f80000000 (Y0Y0SMAP = 0x100000UL base region); anomalous mmap calls targeting this address range from 32-bit compat processes may indicate exploitation. ↗
- ·The vulnerability only affects 64-bit platforms running a 32-bit compatibility layer (CONFIG_COMPAT); pure 64-bit or pure 32-bit systems are not affected. ↗
- ·RHEL 3, 4, 5, and MRG kernels are affected; RHEL 5 is NOT affected by the related CVE-2010-3080 issue. Confirm exact kernel version before applying workarounds. ↗
- ·The binfmt_misc workaround (disabling 32-bit ELF) may not always prevent exploitation in all scenarios; one report suggests it does not universally block the exploit. ↗
- ·The in-memory backdoor left by the Ac1dB1tCh3z exploit is cleared by a reboot; however, a patched kernel still requires a reboot to be effective, so the backdoor detection window is limited to pre-reboot. ↗
- ·The Ksplice detection tool only checks for artifacts placed by the original Ac1dB1tCh3z exploit code; custom or modified exploit variants may not be detected. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vulncheck7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-04-20·CVSS 4.9
CVE-2010-2954 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Multiple security flaws have been fixed in the OMAP4 port of the Linux kernel.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a lo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-28·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Al Viro discovered a race condition in the TTY driver. A local attacker
could exploit this to crash the system, leading to a denial of service.
(CVE-2009-4895)
Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly
check file permissions. A local attacker could overwrite append-only files,
leading to potential data loss. (CVE-2010-2066)
Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly
check file permissions. A local attacker could exploit this to read from
write-only files, leading to a loss of privacy. (CVE-2010-2226)
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory
manager did not properly handle when applications grow stacks into adjacent
memory regi
VMware
Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
vendor_vmware·2011-02-10·CVSS 5.0
CVE-2008-0085 [MEDIUM] Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
VMSA-2011-0003: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX VMware Security Advisory VMware Security Advisory Advisory ID: VMware Security Advisory Synopsis: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX VMware Security Advisory Issue date: VMware Security Advisory Updated on: VMware Security Advisory CVE numbers:
CVEs: CVE-2008-0085, CVE-2008-0086, CVE-2008-0106, CVE-2008-0107, CVE-2008-3825, CVE-2008-5416, CVE-2009-1384, CVE-2009-2693, CVE-2009-2901, CVE-2009-2902, CVE-2009-3548, CVE-2009-3555, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0008, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085,
VMware
VMware ESX third party update for Service Console kernel
vendor_vmware·2010-11-29·CVSS 4.6
CVE-2010-0291 [MEDIUM] VMware ESX third party update for Service Console kernel
VMSA-2010-0017: VMware ESX third party update for Service Console kernel
a. Service Console OS update for COS kernel packag This patch updates the Service Console kernel to fix a stack pointer underflow issue in the 32-bit compatibility layer. Exploitation of this issue could allow a local user to gain additional privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-3081 to this issue. Column 4 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available. VMware Product ============= Product version ======== Running on ======= Replace with/ Apply Patch ================= VMware Product ============= VirtualCenter Product version ======== any Running on ======= Windows Replac
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2010-09-17·CVSS 7.8
CVE-2010-3081 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Local root privilege escalations.
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a local attacker could perform malicious
multicast getsockopt calls to gain root privileges. (CVE-2010-3081)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a
64bit system, a local attacker could manipulate 32bit system calls to
gain root privileges. (Ubuntu 6.06 LTS and 8.04 LTS were not affected.)
(CVE-2010-3301)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Red Hat
kernel: 64-bit Compatibility Mode Stack Pointer Underflow
vendor_redhat·2010-09-15·CVSS 7.8
CVE-2010-3081 [HIGH] CWE-190 kernel: 64-bit Compatibility Mode Stack Pointer Underflow
kernel: 64-bit Compatibility Mode Stack Pointer Underflow
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Statement: More information can be found in this kbase: https://access.redhat.com/kb/docs/DOC-40265.
GHSA
GHSA-24vg-fhqp-9wrx: The compat_alloc_user_space functions in include/asm/compat
ghsa_unreviewed·2022-05-13
CVE-2010-3081 [HIGH] CWE-119 GHSA-24vg-fhqp-9wrx: The compat_alloc_user_space functions in include/asm/compat
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
VulnCheck
Linux Kernel Improper Restriction of Operations within the Bounds of a Memory Buffer
vulncheck·2010·CVSS 7.8
CVE-2010-3081 [HIGH] Linux Kernel Improper Restriction of Operations within the Bounds of a Memory Buffer
Linux Kernel Improper Restriction of Operations within the Bounds of a Memory Buffer
The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://u
Suricata
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2007-0128 [HIGH] ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id ASCII
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id ASCII"; flow:established,to_server; http.uri; content:"/info_book.asp?"; nocase; content:"book_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0128; reference:url,www.milw0rm.com/exploits/3081; classtype:web-application-attack; sid:2005839; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_tech
Suricata
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2007-0128 [HIGH] ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id DELETE
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id DELETE"; flow:established,to_server; http.uri; content:"/info_book.asp?"; nocase; content:"book_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0128; reference:url,www.milw0rm.com/exploits/3081; classtype:web-application-attack; sid:2005838; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_tech
Suricata
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-0128 [HIGH] ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id SELECT
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id SELECT"; flow:established,to_server; http.uri; content:"/info_book.asp?"; nocase; content:"book_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0128; reference:url,www.milw0rm.com/exploits/3081; classtype:web-application-attack; sid:2005835; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_tech
Suricata
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2007-0128 [HIGH] ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UPDATE
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UPDATE"; flow:established,to_server; http.uri; content:"/info_book.asp?"; nocase; content:"book_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0128; reference:url,www.milw0rm.com/exploits/3081; classtype:web-application-attack; sid:2005840; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_techn
Suricata
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2007-0128 [HIGH] ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id INSERT
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id INSERT"; flow:established,to_server; http.uri; content:"/info_book.asp?"; nocase; content:"book_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0128; reference:url,www.milw0rm.com/exploits/3081; classtype:web-application-attack; sid:2005837; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_tech
Suricata
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-0128 [HIGH] ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UNION SELECT
ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Digirez SQL Injection Attempt -- info_book.asp book_id UNION SELECT"; flow:established,to_server; http.uri; content:"/info_book.asp?"; nocase; content:"book_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0128; reference:url,www.milw0rm.com/exploits/3081; classtype:web-application-attack; sid:2005836; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Acces
Bugzilla
CVE-2010-3081 kernel: 64-bit Compatibility Mode Stack Pointer Underflow
bugzilla·2010-09-16·CVSS 7.2
CVE-2010-3081 [HIGH] CVE-2010-3081 kernel: 64-bit Compatibility Mode Stack Pointer Underflow
CVE-2010-3081 kernel: 64-bit Compatibility Mode Stack Pointer Underflow
Description of problem:
A vulnerability in the 32-bit compatibility layer for 64-bit systems was reported. It is caused by insecure allocation of user space memory when translating system call inputs to 64-bit. A stack pointer underflow can occur when using the "compat_alloc_user_space" method with an arbitrary length input.
Reference:
http://sota.gen.nz/compat1/
Upstream commit:
http://git.kernel.org/linus/c41d68a513c71e35a14f66d71782d27a79a81ea6
Acknowledgements:
Red Hat would like to thank Ben Hawkes for reporting this issue.
Discussion:
Exploit: http://seclists.org/fulldisclosure/2010/Sep/268
---
public exploit:
http://seclists.org/fulldisclosure/2010/Sep/268
---
The Red Hat Security Response Team is awa
Bugzilla
CVE-2010-3301 kernel: IA32 System Call Entry Point Vulnerability
bugzilla·2010-09-16·CVSS 7.2
CVE-2010-3301 [HIGH] CVE-2010-3301 kernel: IA32 System Call Entry Point Vulnerability
CVE-2010-3301 kernel: IA32 System Call Entry Point Vulnerability
Description of problem:
CVE-2007-4573 regression
Reintroduced in v2.6.27-rc1 via commit d4d67150.
Upstream commits:
http://git.kernel.org/linus/36d001c70d8a0144ac1d038f6876c484849a74de
http://git.kernel.org/linus/eefdca043e8391dcd719711716492063030b55ac
References:
http://sota.gen.nz/compat2/
Acknowledgements:
Red Hat would like to thank Ben Hawkes for reporting this issue.
Discussion:
Statement:
This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG, as they do not contain the upstream commit d4d67150 that introduced this flaw.
More information can be found in this kbase: https://access.redhat.com/kb/docs/DOC-40330
---
Public exploit: ht
Bugzilla
CVE-2010-2240 kernel: mm: keep a guard page below a grow-down stack segment
bugzilla·2010-06-22·CVSS 7.2
CVE-2010-2240 [HIGH] CVE-2010-2240 kernel: mm: keep a guard page below a grow-down stack segment
CVE-2010-2240 kernel: mm: keep a guard page below a grow-down stack segment
Description of problem:
When an application has a stack overflow, the stack could silently overwrite other memory mapped area instead of causing a segmentation fault.
Acknowledgements:
Red Hat would like to thank the X.Org security team for reporting this issue. Upstream acknowledges Rafal Wojtczuk as the original reporter.
Discussion:
Linus has committed a fix for this issue:
http://git.kernel.org/linus/320b2b8de12698082609ebbc1a17165727f4c893
---
Fixed in 2.6.32.19, 2.6.34.4 and 2.6.35.2. Fixes are in the review stage for 2.6.27.52
---
(In reply to comment #24)
> Linus has committed a fix for this issue:
> http://git.kernel.org/linus/320b2b8de12698082609ebbc1a17165727f4c893
We also need:
http://git.ker
http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.htmlhttp://blog.ksplice.com/2010/09/cve-2010-3081/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c41d68a513c71e35a14f66d71782d27a79a81ea6http://isc.sans.edu/diary.html?storyid=9574http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://marc.info/?l=oss-security&m=128461522230211&w=2http://secunia.com/advisories/42384http://secunia.com/advisories/43315http://sota.gen.nz/compat1/http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.loghttp://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.mandriva.com/security/advisories?name=MDVSA-2010:214http://www.mandriva.com/security/advisories?name=MDVSA-2010:247http://www.redhat.com/support/errata/RHSA-2010-0758.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0842.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0882.htmlhttp://www.securityfocus.com/archive/1/514938/30/30/threadedhttp://www.securityfocus.com/archive/1/516397/100/0/threadedhttp://www.vmware.com/security/advisories/VMSA-2010-0017.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0003.htmlhttp://www.vupen.com/english/advisories/2010/3083http://www.vupen.com/english/advisories/2010/3117http://www.vupen.com/english/advisories/2011/0298https://access.redhat.com/kb/docs/DOC-40265https://bugzilla.redhat.com/show_bug.cgi?id=634457http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.htmlhttp://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.htmlhttp://blog.ksplice.com/2010/09/cve-2010-3081/http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c41d68a513c71e35a14f66d71782d27a79a81ea6http://isc.sans.edu/diary.html?storyid=9574http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://marc.info/?l=oss-security&m=128461522230211&w=2http://secunia.com/advisories/42384http://secunia.com/advisories/43315http://sota.gen.nz/compat1/http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.loghttp://www.mandriva.com/security/advisories?name=MDVSA-2010:198http://www.mandriva.com/security/advisories?name=MDVSA-2010:214http://www.mandriva.com/security/advisories?name=MDVSA-2010:247http://www.redhat.com/support/errata/RHSA-2010-0758.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0842.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0882.htmlhttp://www.securityfocus.com/archive/1/514938/30/30/threadedhttp://www.securityfocus.com/archive/1/516397/100/0/threadedhttp://www.vmware.com/security/advisories/VMSA-2010-0017.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0003.htmlhttp://www.vupen.com/english/advisories/2010/3083http://www.vupen.com/english/advisories/2010/3117http://www.vupen.com/english/advisories/2011/0298https://access.redhat.com/kb/docs/DOC-40265https://bugzilla.redhat.com/show_bug.cgi?id=634457
2010-09-24
Published
Exploited in the wild