CVE-2010-3437
published 2010-10-04CVE-2010-3437: Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain…
PriorityP273medium6.6CVSS 2.0
AVLACLAuNCCINAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.40%
82.2th percentile
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | < 2.6.36 | 2.6.36 |
| linux | linux_kernel | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_real_time_extension | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor ioctl calls to /dev/pktcdvd/control with a negative dev_index value in the pkt_ctrl_command structure (PKT_CTRL_CMD_STATUS command). A negative index bypasses bounds checking in pkt_find_dev_from_minor and enables arbitrary kernel memory read. ↗
- →Detect unprivileged processes (non-root) opening /dev/pktcdvd/control on distributions where the device is accessible to the 'cdrom' group, as exploitation requires this access. ↗
- →Look for mmap of fixed low/negative-offset addresses combined with repeated PKT_CTRL_CMD_STATUS ioctl calls — the exploit maps a fake pktcdvd_device structure in userspace to redirect kernel dereferences and leak 4 bytes of kernel memory per call. ↗
- →The exploit reads the kernel symbol 'pkt_devs' from /proc/kallsyms or /boot/System.map to calculate the dereference address. Monitor for unprivileged reads of /proc/kallsyms followed by pktcdvd ioctl activity. ↗
- ·Red Hat Enterprise Linux 3 and 4 are not affected because they do not include support for the Packet writing layer for ATAPI and SCSI disc media devices. ↗
- ·Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG are not affected in practice because /dev/pktcdvd/control is restricted to root only on those platforms. ↗
- ·The exploit is described as 32-bit only; 64-bit systems may not be directly exploitable with the published PoC. ↗
CVSS provenance
nvdv2.06.6MEDIUMAV:L/AC:L/Au:N/C:C/I:N/A:C
vulncheck6.6MEDIUM
vendor_ubuntu7.2HIGH
vendor_redhat6.6MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-04-20·CVSS 4.9
CVE-2010-2954 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Multiple security flaws have been fixed in the OMAP4 port of the Linux kernel.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a lo
Ubuntu
Linux Kernel vulnerabilities (Marvell Dove)
vendor_ubuntu·2011-03-25·CVSS 7.2
CVE-2010-2478 [HIGH] Linux Kernel vulnerabilities (Marvell Dove)
Title: Linux Kernel vulnerabilities (Marvell Dove)
Summary: An attacker could send crafted input to the kernel and cause it to
crash.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hutchings discovered that the ethtool interface did not correctly check
certain sizes. A local attacker could perform malicious ioctl calls that
could crash the system, leadin
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-28·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Al Viro discovered a race condition in the TTY driver. A local attacker
could exploit this to crash the system, leading to a denial of service.
(CVE-2009-4895)
Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly
check file permissions. A local attacker could overwrite append-only files,
leading to potential data loss. (CVE-2010-2066)
Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly
check file permissions. A local attacker could exploit this to read from
write-only files, leading to a loss of privacy. (CVE-2010-2226)
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory
manager did not properly handle when applications grow stacks into adjacent
memory regi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2010-10-19·CVSS 4.7
CVE-2010-2525 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple security issues fixed.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Al Viro discovered a race condition in the TTY driver. A local attacker
could exploit this to crash the system, leading to a denial of service.
(CVE-2009-4895)
Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly
check file permissions. A local attacker could overwrite append-only files,
leading to potential data loss. (CVE-2010-2066)
Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly
check file permissions. A local attacker could exploit this to read from
write-only files, leading to a loss of privac
Red Hat
kernel: pktcdvd ioctl dev_minor missing range check
vendor_redhat·2010-09-28·CVSS 6.6
CVE-2010-3437 [MEDIUM] kernel: pktcdvd ioctl dev_minor missing range check
kernel: pktcdvd ioctl dev_minor missing range check
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.
Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4 did not include support for Packet writing layer for ATAPI and SCSI disc media devices, and therefore are not affected by this issue. The Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise MRG only allow root access to the "/dev/pktcdvd/control" file, and therefore are also not affected by this issue.
GHSA
GHSA-mw2c-85qx-pgmh: Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd
ghsa_unreviewed·2022-05-13
CVE-2010-3437 [MEDIUM] CWE-476 GHSA-mw2c-85qx-pgmh: Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.
VulnCheck
Linux Kernel NULL Pointer Dereference
vulncheck·2010·CVSS 6.6
CVE-2010-3437 [MEDIUM] Linux Kernel NULL Pointer Dereference
Linux Kernel NULL Pointer Dereference
Integer signedness error in the pkt_find_dev_from_minor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKT_CTRL_CMD_STATUS ioctl call.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://flare.io/learn/resources/blog/old-school-irc-new-victims-inside-the-newly-discovered-sshstalker-linux-botnet
Suricata
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1410 [HIGH] ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UPDATE
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UPDATE"; flow:established,to_server; http.uri; content:"/kategori.asp?"; nocase; content:"kategori="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-1410; reference:url,www.milw0rm.com/exploits/3437; classtype:web-application-attack; sid:2004402; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_na
Suricata
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1410 [HIGH] ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori SELECT
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori SELECT"; flow:established,to_server; http.uri; content:"/kategori.asp?"; nocase; content:"kategori="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-1410; reference:url,www.milw0rm.com/exploits/3437; classtype:web-application-attack; sid:2004397; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_n
Suricata
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2007-1410 [HIGH] ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori ASCII
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori ASCII"; flow:established,to_server; http.uri; content:"/kategori.asp?"; nocase; content:"kategori="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-1410; reference:url,www.milw0rm.com/exploits/3437; classtype:web-application-attack; sid:2004401; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_n
Suricata
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2007-1410 [HIGH] ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori DELETE
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori DELETE"; flow:established,to_server; http.uri; content:"/kategori.asp?"; nocase; content:"kategori="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-1410; reference:url,www.milw0rm.com/exploits/3437; classtype:web-application-attack; sid:2004400; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_n
Suricata
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1410 [HIGH] ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori INSERT
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori INSERT"; flow:established,to_server; http.uri; content:"/kategori.asp?"; nocase; content:"kategori="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-1410; reference:url,www.milw0rm.com/exploits/3437; classtype:web-application-attack; sid:2004399; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_n
Suricata
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-1410 [HIGH] ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UNION SELECT
ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS GaziYapBoz Game Portal SQL Injection Attempt -- kategori.asp kategori UNION SELECT"; flow:established,to_server; http.uri; content:"/kategori.asp?"; nocase; content:"kategori="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-1410; reference:url,www.milw0rm.com/exploits/3437; classtype:web-application-attack; sid:2004398; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, m
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=252a52aa4fa22a668f019e55b3aac3ff71ec1c29http://jon.oberheide.org/files/cve-2010-3437.chttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/42778http://secunia.com/advisories/42801http://secunia.com/advisories/42932http://www.debian.org/security/2010/dsa-2126http://www.exploit-db.com/exploits/15150/http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc6http://www.mandriva.com/security/advisories?name=MDVSA-2011:029http://www.mandriva.com/security/advisories?name=MDVSA-2011:051http://www.openwall.com/lists/oss-security/2010/09/28/2http://www.openwall.com/lists/oss-security/2010/09/28/6http://www.redhat.com/support/errata/RHSA-2010-0842.htmlhttp://www.securityfocus.com/bid/43551http://www.ubuntu.com/usn/USN-1000-1http://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=638085http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=252a52aa4fa22a668f019e55b3aac3ff71ec1c29http://jon.oberheide.org/files/cve-2010-3437.chttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/42778http://secunia.com/advisories/42801http://secunia.com/advisories/42932http://www.debian.org/security/2010/dsa-2126http://www.exploit-db.com/exploits/15150/http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc6http://www.mandriva.com/security/advisories?name=MDVSA-2011:029http://www.mandriva.com/security/advisories?name=MDVSA-2011:051http://www.openwall.com/lists/oss-security/2010/09/28/2http://www.openwall.com/lists/oss-security/2010/09/28/6http://www.redhat.com/support/errata/RHSA-2010-0842.htmlhttp://www.securityfocus.com/bid/43551http://www.ubuntu.com/usn/USN-1000-1http://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=638085
2010-10-04
Published
Exploited in the wild