CVE-2010-2955

The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.1 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 27%
VendorProductVersion
linuxlinux_kernel
𝑥
< 2.6.36
linuxlinux_kernel
2.6.36
linuxlinux_kernel
2.6.36:rc1
linuxlinux_kernel
2.6.36:rc2
opensuseopensuse
11.1
canonicalubuntu_linux
6.06
canonicalubuntu_linux
8.04
canonicalubuntu_linux
9.04
canonicalubuntu_linux
9.10
canonicalubuntu_linux
10.04
canonicalubuntu_linux
10.10
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
not-affected
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
not-affected
maverick
Fixed 2.6.35-22.34
released
lucid
Fixed 2.6.32-26.47
released
karmic
Fixed 2.6.31-22.67
released
jaunty
Fixed 2.6.28-19.66
released
hardy
not-affected
dapper
dne
linux-armadaxp
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
not-affected
precise
not-affected
oneiric
dne
natty
dne
lucid
dne
hardy
dne
linux-backports-modules-2.6.24
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
dne
karmic
dne
jaunty
dne
hardy
ignored
dapper
dne
linux-backports-modules-2.6.28
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
dne
karmic
dne
jaunty
ignored
hardy
dne
dapper
dne
linux-backports-modules-2.6.32
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
ignored
karmic
dne
jaunty
dne
hardy
dne
dapper
dne
linux-ec2
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
ignored
lucid
Fixed 2.6.32-310.21
released
karmic
Fixed 2.6.31-307.21
released
jaunty
dne
hardy
dne
dapper
dne
linux-flo
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
dne
quantal
dne
precise
dne
lucid
dne
linux-fsl-imx51
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
Fixed 2.6.31-608.22
released
karmic
Fixed 2.6.31-112.30
released
hardy
dne
dapper
dne
linux-goldfish
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-grouper
wily
dne
vivid
dne
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-lts-backport-maverick
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
Fixed 2.6.35-22.34~lucid1
released
karmic
dne
jaunty
dne
hardy
dne
dapper
dne
linux-lts-backport-natty
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
not-affected
hardy
dne
linux-lts-backport-oneiric
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
not-affected
hardy
dne
linux-lts-quantal
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
not-affected
oneiric
dne
lucid
dne
hardy
dne
linux-lts-raring
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
not-affected
oneiric
dne
lucid
dne
hardy
dne
linux-lts-saucy
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
not-affected
lucid
dne
linux-lts-trusty
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
precise
not-affected
lucid
dne
linux-lts-utopic
wily
dne
vivid
dne
utopic
dne
trusty
dne
precise
dne
lucid
dne
linux-lts-vivid
wily
dne
vivid
dne
utopic
dne
trusty
dne
precise
dne
lucid
dne
linux-maguro
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-mako
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-manta
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-mvl-dove
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
Fixed 2.6.32-414.30
released
lucid
Fixed 2.6.32-213.29
released
karmic
ignored
hardy
dne
dapper
dne
linux-raspi2
wily
not-affected
vivid
dne
trusty
dne
precise
dne
linux-source-2.6.15
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
dne
karmic
dne
jaunty
dne
hardy
dne
dapper
not-affected
linux-ti-omap4
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
not-affected
maverick
Fixed 2.6.35-903.22
released
lucid
dne
karmic
dne
hardy
dne
dapper
dne
Common Weakness Enumeration
References
http://forums.grsecurity.net/viewtopic.php?f=3&t=2290
http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git%3Ba=commit%3Bh=42da2f948d949efd0111309f5827bf0298bcc9a4
http://grsecurity.net/~spender/wireless-infoleak-fix2.patch
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://lkml.org/lkml/2010/8/27/413
http://lkml.org/lkml/2010/8/30/127
http://lkml.org/lkml/2010/8/30/146
http://lkml.org/lkml/2010/8/30/351
http://secunia.com/advisories/41245
http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.36-rc3-next-20100831.bz2
http://www.openwall.com/lists/oss-security/2010/08/31/1
http://www.redhat.com/support/errata/RHSA-2010-0771.html
http://www.redhat.com/support/errata/RHSA-2010-0842.html
http://www.securityfocus.com/bid/42885
http://www.ubuntu.com/usn/USN-1000-1
http://www.vupen.com/english/advisories/2011/0298
https://bugzilla.redhat.com/show_bug.cgi?id=628434
http://forums.grsecurity.net/viewtopic.php?f=3&t=2290
http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git%3Ba=commit%3Bh=42da2f948d949efd0111309f5827bf0298bcc9a4
http://grsecurity.net/~spender/wireless-infoleak-fix2.patch
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://lkml.org/lkml/2010/8/27/413
http://lkml.org/lkml/2010/8/30/127
http://lkml.org/lkml/2010/8/30/146
http://lkml.org/lkml/2010/8/30/351
http://secunia.com/advisories/41245
http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.36-rc3-next-20100831.bz2
http://www.openwall.com/lists/oss-security/2010/08/31/1
http://www.redhat.com/support/errata/RHSA-2010-0771.html
http://www.redhat.com/support/errata/RHSA-2010-0842.html
http://www.securityfocus.com/bid/42885
http://www.ubuntu.com/usn/USN-1000-1
http://www.vupen.com/english/advisories/2011/0298
https://bugzilla.redhat.com/show_bug.cgi?id=628434