CVE-2010-4158
published 2010-12-30CVE-2010-4158: The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized…
PriorityP412low2.1CVSS 2.0
AVLACLAuNCPINAN
EXPLOIT
EPSS
0.87%
58.4th percentile
The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| linux | linux_kernel | < 2.6.36.2 | 2.6.36.2 |
| linux | linux_kernel | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_real_time_extension | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_workstation | — | — |
| vmware | vsphere | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_ubuntu7.2HIGH
vendor_redhat2.1LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware ESX third party updates for Service Console packages glibc and dhcp
vendor_vmware·2011-10-12·CVSS 4.7
CVE-2010-0296 [MEDIUM] VMware ESX third party updates for Service Console packages glibc and dhcp
VMSA-2011-0012: VMware ESX third party updates for Service Console packages glibc and dhcp
a. ESX third party update for Service Console kernel This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues. The Common Vulnerabilities and Exposures project ( cve.mitre.org) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CV
Ubuntu
Linux kernel (i.MX51) vulnerabilities
vendor_ubuntu·2011-09-13·CVSS 6.9
CVE-2011-2918 [MEDIUM] Linux kernel (i.MX51) vulnerabilities
Title: Linux kernel (i.MX51) vulnerabilities
Summary: Multiple kernel flaws have been fixed.
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that multiple terminal ioctls did not correctly
initialize structure memory. A local attacker could exploit this to read
portions of kernel stack memory, leading to a loss of privacy.
(CVE-2010-4075, CVE-2010-4076, CVE-2010-4077)
Dan Rosenberg discovered that the socket filters did not correctly
initialize structure memory. A local attacker could create malicious
filters to read portions of kernel stack memory, leading to a loss of
privacy. (CVE-2010-4158)
Dan Rosenberg discovered t
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-04-20·CVSS 4.9
CVE-2010-2954 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Multiple security flaws have been fixed in the OMAP4 port of the Linux kernel.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a lo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-04-05·CVSS 1.9
CVE-2010-4075 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that multiple terminal ioctls did not correctly
initialize structure memory. A local attacker could exploit this to read
portions of kernel stack memory, leading to a loss of privacy.
(CVE-2010-4075)
Dan Rosenberg discovered that the socket filters did not correctly
initialize structure memory. A local attacker could create malicious
filters to read portions of kernel stack memory, leading to a loss of
privacy. (CVE-2010-4158)
Dan Rosenberg discovered that certain iovec operations did not calculate
page counts correctly. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-4162)
Dan Rosenberg discovered that the SCSI subsystem did not correctly val
Ubuntu
Linux Kernel vulnerabilities (Marvell Dove)
vendor_ubuntu·2011-03-25·CVSS 7.2
CVE-2010-2478 [HIGH] Linux Kernel vulnerabilities (Marvell Dove)
Title: Linux Kernel vulnerabilities (Marvell Dove)
Summary: An attacker could send crafted input to the kernel and cause it to
crash.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hutchings discovered that the ethtool interface did not correctly check
certain sizes. A local attacker could perform malicious ioctl calls that
could crash the system, leadin
Ubuntu
Linux Kernel vulnerabilities
vendor_ubuntu·2011-03-25·CVSS 1.9
CVE-2010-4075 [LOW] Linux Kernel vulnerabilities
Title: Linux Kernel vulnerabilities
Summary: A local attacker could exploit this to run programs with admininstrator
privileges.
Dan Rosenberg discovered that multiple terminal ioctls did not correctly
initialize structure memory. A local attacker could exploit this to read
portions of kernel stack memory, leading to a loss of privacy.
(CVE-2010-4075, CVE-2010-4077)
Dan Rosenberg discovered that the socket filters did not correctly
initialize structure memory. A local attacker could create malicious
filters to read portions of kernel stack memory, leading to a loss of
privacy. (CVE-2010-4158)
Dan Rosenberg discovered that certain iovec operations did not calculate
page counts correctly. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-4
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-18·CVSS 1.9
CVE-2010-4075 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel vulnerabilities.
Dan Rosenberg discovered that multiple terminal ioctls did not correctly
initialize structure memory. A local attacker could exploit this to read
portions of kernel stack memory, leading to a loss of privacy.
(CVE-2010-4075, CVE-2010-4076, CVE-2010-4077)
Dan Rosenberg discovered that the socket filters did not correctly
initialize structure memory. A local attacker could create malicious
filters to read portions of kernel stack memory, leading to a loss of
privacy. (CVE-2010-4158)
Dan Rosenberg discovered that certain iovec operations did not calculate
page counts correctly. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-4162)
Dan Rosenberg discovered that
Ubuntu
Linux kernel (EC2) vulnerabilities
vendor_ubuntu·2011-03-08·CVSS 1.9
CVE-2010-4075 [LOW] Linux kernel (EC2) vulnerabilities
Title: Linux kernel (EC2) vulnerabilities
Summary: Multiple kernel vulnerabilities.
Dan Rosenberg discovered that multiple terminal ioctls did not correctly
initialize structure memory. A local attacker could exploit this to read
portions of kernel stack memory, leading to a loss of privacy.
(CVE-2010-4075)
Dan Rosenberg discovered that the socket filters did not correctly
initialize structure memory. A local attacker could create malicious
filters to read portions of kernel stack memory, leading to a loss of
privacy. (CVE-2010-4158)
Dan Rosenberg discovered that the SCSI subsystem did not correctly validate
iov segments. A local attacker with access to a SCSI device could send
specially crafted requests to crash the system, leading to a denial of
service. (CVE-2010-4163, CVE-2010-4668
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-01·CVSS 4.6
CVE-2010-4079 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel vulnerablilities.
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Dan Rosenberg discovered that the CAN protocol on 64bit systems did not
correctly calculate th
Red Hat
kernel: rhel5 commit 6865201191 caused deadlock
vendor_redhat·2010-11-10·CVSS 2.1
CVE-2010-4161 [LOW] kernel: rhel5 commit 6865201191 caused deadlock
kernel: rhel5 commit 6865201191 caused deadlock
The udp_queue_rcv_skb function in net/ipv4/udp.c in a certain Red Hat build of the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (deadlock and system hang) by sending UDP traffic to a socket that has a crafted socket filter, a related issue to CVE-2010-4158.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not backport the upstream commit 93821778 that introduced this. It did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they have backported the upstream commit fda9ef5d that addressed this. Future kernel update in Red Hat Enterprise Linux 5 may addres
Red Hat
kernel: socket filters infoleak
vendor_redhat·2010-11-10·CVSS 2.1
CVE-2010-4158 [LOW] kernel: socket filters infoleak
kernel: socket filters infoleak
The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.
GHSA
GHSA-jch4-5383-w2vq: The udp_queue_rcv_skb function in net/ipv4/udp
ghsa_unreviewed·2022-05-14·CVSS 2.1
CVE-2010-4161 [LOW] GHSA-jch4-5383-w2vq: The udp_queue_rcv_skb function in net/ipv4/udp
The udp_queue_rcv_skb function in net/ipv4/udp.c in a certain Red Hat build of the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (deadlock and system hang) by sending UDP traffic to a socket that has a crafted socket filter, a related issue to CVE-2010-4158.
GHSA
GHSA-9x53-5f6r-73cq: The sk_run_filter function in net/core/filter
ghsa_unreviewed·2022-05-13
CVE-2010-4158 [LOW] CWE-200 GHSA-9x53-5f6r-73cq: The sk_run_filter function in net/core/filter
The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.
No detection rules found.
Bugzilla
CVE-2010-4161 kernel: rhel5 commit 6865201191 caused deadlock
bugzilla·2010-11-12·CVSS 2.1
CVE-2010-4161 [LOW] CVE-2010-4161 kernel: rhel5 commit 6865201191 caused deadlock
CVE-2010-4161 kernel: rhel5 commit 6865201191 caused deadlock
Using the reproducer for CVE-2010-4158,
BUG: soft lockup - CPU#2 stuck for 60s! [a.out:4362]
CPU 2:
Modules linked in: autofs4 hidp rfcomm l2cap bluetooth lockd sunrpc cpufreq_ondemand acpi_cpufreq freq_table mperf ipv6 xfrm_nalgo crypto_api loop dm_multipath scsi_dh video backlight sbs power_meter hwmon i2c_ec i2c_core dell_wmi wmi button battery asus_acpi acpi_memhotplug ac parport_pc lp parport joydev ixgbe floppy bnx2 8021q ide_cd sr_mod i5000_edac serio_raw dca edac_mc tpm_tis cdrom tpm tpm_bios sg pcspkr dm_raid45 dm_message dm_region_hash dm_mem_cache dm_snapshot dm_zero dm_mirror dm_log dm_mod usb_storage ata_piix libata shpchp megaraid_sas sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd
Pid: 4362, comm: a.out Not t
Bugzilla
CVE-2010-4158 kernel: socket filters infoleak
bugzilla·2010-11-10·CVSS 2.1
CVE-2010-4158 [LOW] CVE-2010-4158 kernel: socket filters infoleak
CVE-2010-4158 kernel: socket filters infoleak
Description of problem:
The "mem" array used as scratch space for socket filters is not initialized, allowing unprivileged users to leak kernel stack bytes.
http://www.spinics.net/lists/netdev/msg146361.html
http://lists.grok.org.uk/pipermail/full-disclosure/2010-November/077321.html
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Discussion:
This issue has been assigned the name CVE-2010-4158.
---
We are aware that the public reproducer caused a deadlock issue on rhel-5. We have filed separate bugs for that. See CVE-2010-4161.
---
Upstream commit:
http://git.kernel.org/linus/57fe93b374a6b8711995c2d466c502af9f3a08bb
---
This issue has been addressed in following products:
MRG for RHEL-5
Via RH
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=57fe93b374a6b8711995c2d466c502af9f3a08bbhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2010-November/077321.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.htmlhttp://secunia.com/advisories/42745http://secunia.com/advisories/42778http://secunia.com/advisories/42801http://secunia.com/advisories/42884http://secunia.com/advisories/42890http://secunia.com/advisories/42932http://secunia.com/advisories/42963http://secunia.com/advisories/43291http://secunia.com/advisories/46397http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.mandriva.com/security/advisories?name=MDVSA-2011:029http://www.redhat.com/support/errata/RHSA-2010-0958.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0007.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0017.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0162.htmlhttp://www.securityfocus.com/archive/1/514705http://www.securityfocus.com/archive/1/514845http://www.securityfocus.com/archive/1/520102/100/0/threadedhttp://www.securityfocus.com/bid/44758http://www.spinics.net/lists/netdev/msg146361.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0012.htmlhttp://www.vupen.com/english/advisories/2010/3321http://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0168http://www.vupen.com/english/advisories/2011/0298http://www.vupen.com/english/advisories/2011/0375https://bugzilla.redhat.com/show_bug.cgi?id=651698http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=57fe93b374a6b8711995c2d466c502af9f3a08bbhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.htmlhttp://lists.grok.org.uk/pipermail/full-disclosure/2010-November/077321.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.htmlhttp://secunia.com/advisories/42745http://secunia.com/advisories/42778http://secunia.com/advisories/42801http://secunia.com/advisories/42884http://secunia.com/advisories/42890http://secunia.com/advisories/42932http://secunia.com/advisories/42963http://secunia.com/advisories/43291http://secunia.com/advisories/46397http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.mandriva.com/security/advisories?name=MDVSA-2011:029http://www.redhat.com/support/errata/RHSA-2010-0958.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0007.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0017.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0162.htmlhttp://www.securityfocus.com/archive/1/514705http://www.securityfocus.com/archive/1/514845http://www.securityfocus.com/archive/1/520102/100/0/threadedhttp://www.securityfocus.com/bid/44758http://www.spinics.net/lists/netdev/msg146361.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0012.htmlhttp://www.vupen.com/english/advisories/2010/3321http://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0168http://www.vupen.com/english/advisories/2011/0298http://www.vupen.com/english/advisories/2011/0375https://bugzilla.redhat.com/show_bug.cgi?id=651698
2010-12-30
Published