CVE-2010-4160
published 2011-01-07CVE-2010-4160: Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the…
PriorityP422medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
0.53%
41.6th percentile
Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | < 2.6.36.2 | 2.6.36.2 |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_ubuntu7.2HIGH
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
vendor_paloalto·2024-09-04·CVSS 6.0
CVE-2022-22965 [MEDIUM] PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
PAN-SA-2024-0008 Informational Bulletin: Impact of OSS CVEs in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS software. While PAN-OS software may include the
CVEs: CVE-2010-1622, CVE-2015-7552, CVE-2018-16840, CVE-2019-7639, CVE-2020-17049, CVE-2020-7774, CVE-2021-0131, CVE-2021-0132, CVE-2021-0133, CVE-2021-0134, CVE-2021-4044, CVE-2021-4160, CVE-2021-41773, CVE-2022-1343, CVE-2022-21449, CVE-2022-2274, CVE-2022-22963, CVE-2022-22965, CVE-2022-24697, CVE-2022-32207, CVE-2022-3358, CVE-2022-3996, CVE-2022-40664, CVE-2022-44792, CVE-2022-44793, CVE-2023-1255, CVE-2023-22809, CVE-2023-23919, CVE-2023-3341, CVE-2023-4236, CVE-2023-4863, CVE-2023-51767
Affected products: PAN-OS
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-09-13·CVSS 2.1
CVE-2011-1171 [LOW] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Multiple kernel flaws have been fixed.
Dan Rosenberg discovered that several network ioctls did not clear kernel
memory correctly. A local user could exploit this to read kernel stack
memory, leading to a loss of privacy. (CVE-2010-3296, CVE-2010-3297)
Brad Spengler discovered that stack memory for new a process was not
correctly calculated. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-3858)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that the CAN protocol on 64bit systems did not
correctly calculate the size of
Ubuntu
Linux kernel (i.MX51) vulnerabilities
vendor_ubuntu·2011-09-13·CVSS 6.9
CVE-2011-2918 [MEDIUM] Linux kernel (i.MX51) vulnerabilities
Title: Linux kernel (i.MX51) vulnerabilities
Summary: Multiple kernel flaws have been fixed.
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that multiple terminal ioctls did not correctly
initialize structure memory. A local attacker could exploit this to read
portions of kernel stack memory, leading to a loss of privacy.
(CVE-2010-4075, CVE-2010-4076, CVE-2010-4077)
Dan Rosenberg discovered that the socket filters did not correctly
initialize structure memory. A local attacker could create malicious
filters to read portions of kernel stack memory, leading to a loss of
privacy. (CVE-2010-4158)
Dan Rosenberg discovered t
Ubuntu
Linux Kernel vulnerabilities (Marvell Dove)
vendor_ubuntu·2011-03-25·CVSS 7.2
CVE-2010-2478 [HIGH] Linux Kernel vulnerabilities (Marvell Dove)
Title: Linux Kernel vulnerabilities (Marvell Dove)
Summary: An attacker could send crafted input to the kernel and cause it to
crash.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hutchings discovered that the ethtool interface did not correctly check
certain sizes. A local attacker could perform malicious ioctl calls that
could crash the system, leadin
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.9
CVE-2010-3086 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Tavis Ormandy discovered that the Linux kernel did not properly implement
exception fixup. A local attacker could exploit this to crash the kernel,
leading to a denial of service. (CVE-2010-3086)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Vasiliy Kulikov discovered that the Linux kernel X.25 implementation did
not correctly clear kernel memory. A local attacker could exploit this to
read kernel stack memor
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.6
CVE-2010-4078 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dan Jacobson discovered that ThinkPad video output was not correctly access
controlled. A local attacker could exploit this to hang the system, leading
to a denial of service. (CVE-2010-3448)
It was discovered that KVM did not correctly initialize certain CPU
registers. A local attacker could exploit this to crash the system, leading
to a denial of service. (CVE-2010-3698)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local at
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.6
CVE-2010-3699 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dave Chinner discovered that the XFS filesystem did not correctly order
inode lookups when exported by NFS. A remote attacker could exploit this to
read or write disk blocks that had changed file assignment or had become
unlinked, leading to a loss of privacy. (CVE-2010-2943)
Dan Rosenberg discovered that several network ioctls did not clear kernel
memory correctly. A local user could exploit this to read kernel stack
memory, leading to a loss of privacy. (CVE-2010-3296, CVE-2010-3297)
Dan Jaco
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-01·CVSS 4.6
CVE-2010-4079 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel vulnerablilities.
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Dan Rosenberg discovered that the CAN protocol on 64bit systems did not
correctly calculate th
Red Hat
kernel: L2TP send buffer allocation size overflows
vendor_redhat·2010-11-01·CVSS 6.9
CVE-2010-4160 [MEDIUM] kernel: L2TP send buffer allocation size overflows
kernel: L2TP send buffer allocation size overflows
Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.
Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4 and 5 did not
include L2TP functionality, and therefore are not affected by this
issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat
Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0007.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.
GHSA
GHSA-xvf7-379r-cpg2: Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp
ghsa_unreviewed·2022-05-13
CVE-2010-4160 [MEDIUM] CWE-190 GHSA-xvf7-379r-cpg2: Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp
Multiple integer overflows in the (1) pppol2tp_sendmsg function in net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (heap memory corruption and panic) or possibly gain privileges via a crafted sendto call.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-4650 kernel: fuse: verify ioctl retries
bugzilla·2011-01-07·CVSS 6.9
CVE-2010-4650 [MEDIUM] CVE-2010-4650 kernel: fuse: verify ioctl retries
CVE-2010-4650 kernel: fuse: verify ioctl retries
Verify that the total length of the iovec returned in FUSE_IOCTL_RETRY
doesn't overflow iov_length().
Upstream commit:
http://git.kernel.org/linus/7572777eef78ebdee1ecb7c258c0ef94d35bad16
Introduced in 59efec7b v2.6.29-rc1
long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg,
unsigned int flags)
{
[...]
/* did it ask for retry? */
if (outarg.flags & FUSE_IOCTL_RETRY) {
[...]
/* no retry if in restricted mode */
err = -EIO;
if (!(flags & FUSE_IOCTL_UNRESTRICTED))
goto out;
[...]
in_iov = page_address(iov_page);
out_iov = in_iov + in_iovs;
So this affects unrestricted ioctl that is used by CUSE. Others use restricted ioctl.
On Red Hat Enterprise Linux 6, /dev/cuse is root-owned by default.
crw-rw----. 1 root root 10,
Bugzilla
CVE-2010-4160 kernel: L2TP send buffer allocation size overflows
bugzilla·2010-11-10·CVSS 6.9
CVE-2010-4160 [MEDIUM] CVE-2010-4160 kernel: L2TP send buffer allocation size overflows
CVE-2010-4160 kernel: L2TP send buffer allocation size overflows
Description of problem:
Both PPPoL2TP (in net/l2tp/l2tp_ppp.c, pppol2tp_sendmsg()) and IPoL2TP (in net/l2tp/l2tp_ip.c, l2tp_ip_sendmsg()) make calls to sock_wmalloc() that perform arithmetic on the size argument without any maximum bound. As a result, by issuing sendto() calls with very large sizes, this allocation size will wrap and result in a small buffer being allocated, leading to ugliness immediately after (probably kernel panics due to bad sk_buff tail position, but possibly kernel heap corruption).
Reference:
http://www.spinics.net/lists/netdev/msg145673.html
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Discussion:
Statement:
The Linux kernel as shipped with Red Hat Ente
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=253eacc070b114c2ec1f81b067d2fed7305467b0http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8acfe468b0384e834a303f08ebc4953d72fb690ahttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.htmlhttp://openwall.com/lists/oss-security/2010/11/10/16http://openwall.com/lists/oss-security/2010/11/10/5http://openwall.com/lists/oss-security/2010/11/24/12http://openwall.com/lists/oss-security/2010/11/24/4http://openwall.com/lists/oss-security/2010/11/24/5http://openwall.com/lists/oss-security/2010/11/24/6http://secunia.com/advisories/42801http://secunia.com/advisories/42890http://secunia.com/advisories/42932http://secunia.com/advisories/43056http://secunia.com/advisories/43291http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.redhat.com/support/errata/RHSA-2011-0007.htmlhttp://www.securityfocus.com/bid/44762http://www.spinics.net/lists/netdev/msg145248.htmlhttp://www.spinics.net/lists/netdev/msg145673.htmlhttp://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0213http://www.vupen.com/english/advisories/2011/0375http://xorl.wordpress.com/2010/11/11/cve-2010-4160-linux-kernel-l2tp-integer-overflows/https://bugzilla.redhat.com/show_bug.cgi?id=651892http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=253eacc070b114c2ec1f81b067d2fed7305467b0http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8acfe468b0384e834a303f08ebc4953d72fb690ahttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.htmlhttp://openwall.com/lists/oss-security/2010/11/10/16http://openwall.com/lists/oss-security/2010/11/10/5http://openwall.com/lists/oss-security/2010/11/24/12http://openwall.com/lists/oss-security/2010/11/24/4http://openwall.com/lists/oss-security/2010/11/24/5http://openwall.com/lists/oss-security/2010/11/24/6http://secunia.com/advisories/42801http://secunia.com/advisories/42890http://secunia.com/advisories/42932http://secunia.com/advisories/43056http://secunia.com/advisories/43291http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2http://www.redhat.com/support/errata/RHSA-2011-0007.htmlhttp://www.securityfocus.com/bid/44762http://www.spinics.net/lists/netdev/msg145248.htmlhttp://www.spinics.net/lists/netdev/msg145673.htmlhttp://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0213http://www.vupen.com/english/advisories/2011/0375http://xorl.wordpress.com/2010/11/11/cve-2010-4160-linux-kernel-l2tp-integer-overflows/https://bugzilla.redhat.com/show_bug.cgi?id=651892
2011-01-07
Published