CVE-2010-3849
published 2010-12-30CVE-2010-3849: The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a…
PriorityP272medium4.7CVSS 2.0
AVLACMAuNCNINAC
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
0.71%
49.5th percentile
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| linux | linux_kernel | < 2.6.36.2 | 2.6.36.2 |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_real_time_extension | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit requires an unprivileged local user to assign an econet address to an interface via SIOCSIFADDR ioctl (CVE-2010-3850) before the NULL dereference in econet_sendmsg (CVE-2010-3849) becomes reachable — monitor unprivileged SIOCSIFADDR calls on the econet socket family (AF_ECONET / PF_ECONET). ↗
- →The exploit chains CVE-2010-3849 with CVE-2010-4258: it uses clone(2) with CLONE_CHILD_CLEARTID and set_fs(KERNEL_DS) to convert the kernel OOPS into a controlled write of integer 0 to a kernel-space address — detect processes using CLONE_CHILD_CLEARTID in combination with AF_ECONET socket creation. ↗
- →The exploit reads /proc/kallsyms or /boot/System.map-<uname -r> to resolve commit_creds and prepare_kernel_cred kernel symbols — monitor for unprivileged processes opening /proc/kallsyms or /boot/System.map-* files. ↗
- →The exploit maps a NULL page (address 0) with PROT_EXEC using MAP_FIXED to place a trampoline payload — detect mmap calls targeting address 0x0 with PROT_EXEC | MAP_FIXED from unprivileged processes. ↗
- →The trigger function sets the interface name to 'eth0' via SIOCSIFADDR on an econet socket — look for SIOCSIFADDR ioctls on AF_ECONET sockets targeting common interface names from non-root processes. ↗
- →Systems with panic_on_oops enabled are not exploitable via the CVE-2010-4258 chained write primitive — verify sysctl kernel.panic_on_oops=1 as a compensating control. ↗
- ·CVE-2010-3849 is only exploitable when an econet address is configured on the system; the kernel must be built with AF_ECONET / CONFIG_ECONET support. ↗
- ·Red Hat Enterprise Linux 3/4/5/6 and MRG kernels are not affected because they do not ship with Acorn Econet protocol support. ↗
- ·The chained privilege escalation (via CVE-2010-4258) requires panic_on_oops to be disabled; systems with panic_on_oops=1 (RHEL default) will panic rather than allow the controlled kernel write. ↗
- ·The stack overflow variant (CVE-2010-3848) requires CONFIG_ECONET_AUNUDP to be enabled, as the vulnerable variable-length array is inside an #ifdef CONFIG_ECONET_AUNUDP block. ↗
CVSS provenance
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:N/I:N/A:C
vulncheck4.7MEDIUM
vendor_ubuntu7.2HIGH
vendor_redhat4.7MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-04-20·CVSS 4.9
CVE-2010-2954 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Multiple security flaws have been fixed in the OMAP4 port of the Linux kernel.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a lo
Ubuntu
Linux Kernel vulnerabilities (Marvell Dove)
vendor_ubuntu·2011-03-25·CVSS 7.2
CVE-2010-2478 [HIGH] Linux Kernel vulnerabilities (Marvell Dove)
Title: Linux Kernel vulnerabilities (Marvell Dove)
Summary: An attacker could send crafted input to the kernel and cause it to
crash.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hutchings discovered that the ethtool interface did not correctly check
certain sizes. A local attacker could perform malicious ioctl calls that
could crash the system, leadin
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-28·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Al Viro discovered a race condition in the TTY driver. A local attacker
could exploit this to crash the system, leading to a denial of service.
(CVE-2009-4895)
Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly
check file permissions. A local attacker could overwrite append-only files,
leading to potential data loss. (CVE-2010-2066)
Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly
check file permissions. A local attacker could exploit this to read from
write-only files, leading to a loss of privacy. (CVE-2010-2226)
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory
manager did not properly handle when applications grow stacks into adjacent
memory regi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2010-11-30·CVSS 2.1
CVE-2010-2955 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: The Linux kernel could be made to run unauthorized programs with
administrator privileges.
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Brad Spengler discovered that the wireless extensions did not correctly
validate certain request sizes. A local attacker could exploit this to read
portions of kernel memory, leading to a loss of privacy. (CVE-2010-2955)
Dan Rosenberg discovered that the VIA video driver did not correctly clear
kernel memory. A local attacker could exploit this to
Red Hat
kernel: multiple vulnerabilities in Linux AF_ECONET
vendor_redhat·CVSS 4.7
CVE-2010-3849 [MEDIUM] kernel: multiple vulnerabilities in Linux AF_ECONET
kernel: multiple vulnerabilities in Linux AF_ECONET
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.
GHSA
GHSA-23jc-mx6c-hh36: The econet_sendmsg function in net/econet/af_econet
ghsa_unreviewed·2022-05-13
CVE-2010-3849 [MEDIUM] CWE-476 GHSA-23jc-mx6c-hh36: The econet_sendmsg function in net/econet/af_econet
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.
Kernel
do_exit(): make sure that we run with get_fs() == USER_DS
kernel_security·2010-12-02·CVSS 4.7
CVE-2010-3849 [MEDIUM] do_exit(): make sure that we run with get_fs() == USER_DS
do_exit(): make sure that we run with get_fs() == USER_DS
If a user manages to trigger an oops with fs set to KERNEL_DS, fs is not
otherwise reset before do_exit(). do_exit may later (via mm_release in
fork.c) do a put_user to a user-controlled address, potentially allowing
a user to leverage an oops into a controlled write into kernel memory.
This is only triggerable in the presence of another bug, but this
potentially turns a lot of DoS bugs into privilege escalations, so it's
worth fixing. I have proof-of-concept code which uses this bug along
with CVE-2010-3849 to write a zero to an arbitrary kernel address, so
I've tested that this is not theoretical.
A more logical place to put this fix might be when we know an oops has
occurred, before we call do_exit(), but that would involve ch
Kernel
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
kernel_security·2010-11-29·CVSS 6.9
CVE-2010-3848 [MEDIUM] Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (27 commits)
af_unix: limit recursion level
pch_gbe driver: The wrong of initializer entry
pch_gbe dreiver: chang author
ucc_geth: fix ucc halt problem in half duplex mode
inet: Fix __inet_inherit_port() to correctly increment bsockets and num_owners
ehea: Add some info messages and fix an issue
hso: fix disable_net
NET: wan/x25_asy, move lapb_unregister to x25_asy_close_tty
cxgb4vf: fix setting unicast/multicast addresses ...
net, ppp: Report correct error code if unit allocation failed
DECnet: don't leak uninitialized stack byte
au1000_eth: fix invalid address accessing the MAC enable register
dccp: fix error in updating the GAR
tcp: restrict net.ipv4.tcp_adv_
Kernel
econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
kernel_security·2010-11-24·CVSS 4.7
CVE-2010-3849 [MEDIUM] econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
econet: disallow NULL remote addr for sendmsg(), fixes CVE-2010-3849
Later parts of econet_sendmsg() rely on saddr != NULL, so return early
with EINVAL if NULL was passed otherwise an oops may occur.
Signed-off-by: Phil Blundell
Signed-off-by: David S. Miller
VulnCheck
Linux Kernel NULL Pointer Dereference
vulncheck·2010·CVSS 4.7
CVE-2010-3849 [MEDIUM] Linux Kernel NULL Pointer Dereference
Linux Kernel NULL Pointer Dereference
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.36.2, when an econet address is configured, allows local users to cause a denial of service (NULL pointer dereference and OOPS) via a sendmsg call that specifies a NULL value for the remote address field.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://flare.io/learn/resources/blog/old-school-irc-new-victims-inside-the-newly-discovered-sshstalker-linux-botnet
No detection rules found.
Exploit-DB
Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation
exploitdb·2010-12-07·CVSS 4.7
CVE-2010-4258 [MEDIUM] Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation
Linux Kernel 2.6.37 (RedHat / Ubuntu 10.04) - 'Full-Nelson.c' Local Privilege Escalation
---
/*
* Linux Kernel
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
/* How many bytes should we clear in our
* function pointer to put it into userspace? */
#ifdef __x86_64__
#define SHIFT 24
#define OFFSET 3
#else
#define SHIFT 8
#define OFFSET 1
#endif
/* thanks spender... */
unsigned long get_kernel_sym(char *name)
{
FILE *f;
unsigned long addr;
char dummy;
char sname[512];
struct utsname ver;
int ret;
int rep = 0;
int oldstyle = 0;
f = fopen("/proc/kallsyms", "r");
if (f == NULL) {
f = fopen("/proc/ksyms", "r");
if (f == NULL)
goto fallback;
oldstyle = 1;
}
repeat:
ret = 0;
while(ret != EOF) {
if (!oldstyle)
ret = fscanf(f, "%p %c %s\n", (v
Exploit-DB
HP OpenView Network Node Manager (OV NNM) - 'Snmp.exe' CGI Buffer Overflow (Metasploit)
exploitdb·2010-11-11
CVE-2009-3849 HP OpenView Network Node Manager (OV NNM) - 'Snmp.exe' CGI Buffer Overflow (Metasploit)
HP OpenView Network Node Manager (OV NNM) - 'Snmp.exe' CGI Buffer Overflow (Metasploit)
---
##
# $Id: hp_nnm_snmp.rb 10998 2010-11-11 22:43:22Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'HP OpenView Network Node Manager Snmp.exe CGI Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in HP OpenView Network Node Manager 7.50.
By sending a specially crafted CGI request to Snmp.exe, an attacker may be able to execute
arbitrary code.
},
'Author' => [ 'MC' ],
'License' => MSF_LICENSE,
'Version' => '$R
Bugzilla
CVE-2010-4258 kernel: failure to revert address limit override in OOPS error path
bugzilla·2010-12-03·CVSS 4.7
CVE-2010-4258 [MEDIUM] CVE-2010-4258 kernel: failure to revert address limit override in OOPS error path
CVE-2010-4258 kernel: failure to revert address limit override in OOPS error path
Nelson discovered an interesting interaction in the Linux kernel between the clear_child_tid feature of clone(2), and the set_fs() function used internally in the kernel to temporarily disable access_ok() checking of userspace pointers.
Under some (not totally uncommon) circumstances, it is possible for a user to leverage this interaction to turn a kernel oops or BUG() into a write of an integer 0 to a user-controlled address in kernel memory.
This is known to be exploited with CVE-2010-3849 - http://www.redhat.com/security/data/cve/CVE-2010-3849.html.
Acknowledgements:
Red Hat would like to thank Nelson Elhage for reporting this issue.
Discussion:
This needs oops to first trigger the mm_release path w
Bugzilla
CVE-2010-3848 CVE-2010-3849 CVE-2010-3850 kernel: multiple vulnerabilities in Linux AF_ECONET
bugzilla·2010-10-19·CVSS 6.9
CVE-2010-3848 [MEDIUM] CVE-2010-3848 CVE-2010-3849 CVE-2010-3850 kernel: multiple vulnerabilities in Linux AF_ECONET
CVE-2010-3848 CVE-2010-3849 CVE-2010-3850 kernel: multiple vulnerabilities in Linux AF_ECONET
Description of problem:
Reported by Nelson Elhage.
CVE-2010-3848 AF_ECONET kernel stack overflow
CVE-2010-3849 AF_ECONET saddr->cookie NULL dereferences
CVE-2010-3850 AF_ECONET SIOCSIFADDR ioctl does not check privileges
The two main vulnerabilities lie in the econet_sendmsg() function. If CONFIG_ECONET_AUNUDP, the function declares a variable-length array of iovec's
on the stack:
static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
struct msghdr *msg, size_t len)
{
...
#ifdef CONFIG_ECONET_AUNUDP
...
struct iovec iov[msg->msg_iovlen+1];
...
#endif
"msg->msg_iovlen" is a user-controlled value cookie = saddr->cookie;
In fact, 'saddr' comes from userspace and may be NULL (if non-
http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0086.htmlhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fa0e846494792e722d817b9d3d625a4ef4896c96http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.htmlhttp://openwall.com/lists/oss-security/2010/11/30/1http://secunia.com/advisories/43056http://secunia.com/advisories/43291http://www.debian.org/security/2010/dsa-2126http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.mandriva.com/security/advisories?name=MDVSA-2010:257http://www.ubuntu.com/usn/USN-1023-1http://www.vupen.com/english/advisories/2011/0213http://www.vupen.com/english/advisories/2011/0298http://www.vupen.com/english/advisories/2011/0375https://bugzilla.redhat.com/show_bug.cgi?id=644156http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0086.htmlhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fa0e846494792e722d817b9d3d625a4ef4896c96http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.htmlhttp://openwall.com/lists/oss-security/2010/11/30/1http://secunia.com/advisories/43056http://secunia.com/advisories/43291http://www.debian.org/security/2010/dsa-2126http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.mandriva.com/security/advisories?name=MDVSA-2010:257http://www.ubuntu.com/usn/USN-1023-1http://www.vupen.com/english/advisories/2011/0213http://www.vupen.com/english/advisories/2011/0298http://www.vupen.com/english/advisories/2011/0375https://bugzilla.redhat.com/show_bug.cgi?id=644156
2010-12-30
Published
Exploited in the wild