CVE-2010-2959

EUVD-2010-2963
Integer overflow in net/can/bcm.c in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows attackers to execute arbitrary code or cause a denial of service (system crash) via crafted CAN traffic.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 59%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
𝑥
< 2.6.27.53
linuxlinux_kernel
2.6.32 ≤
𝑥
< 2.6.32.21
linuxlinux_kernel
2.6.34 ≤
𝑥
< 2.6.34.6
linuxlinux_kernel
2.6.35 ≤
𝑥
< 2.6.35.4
debiandebian_linux
5.0
opensuseopensuse
11.3
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
dapper
dne
hardy
not-affected
jaunty
Fixed 2.6.28-19.64
released
karmic
Fixed 2.6.31-22.63
released
lucid
Fixed 2.6.32-24.41
released
maverick
Fixed 2.6.35-18.24
released
linux-ec2
dapper
dne
hardy
dne
karmic
Fixed 2.6.31-307.17
released
lucid
Fixed 2.6.32-308.15
released
maverick
ignored
linux-fsl-imx51
dapper
dne
hardy
dne
karmic
Fixed 2.6.31-112.30
released
lucid
Fixed 2.6.31-608.19
released
maverick
dne
linux-mvl-dove
dapper
dne
hardy
dne
karmic
Fixed 2.6.31-214.30
released
lucid
Fixed 2.6.32-208.24
released
maverick
not-affected
linux-source-2.6.15
dapper
not-affected
hardy
dne
jaunty
dne
karmic
dne
lucid
dne
maverick
dne
Common Weakness Enumeration
References
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b75c4973ce779520b9d1e392483207d6f842cde
http://jon.oberheide.org/files/i-can-haz-modharden.c
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046947.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://secunia.com/advisories/41512
http://www.debian.org/security/2010/dsa-2094
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.53
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.21
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34.6
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.4
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198
http://www.openwall.com/lists/oss-security/2010/08/20/2
http://www.securityfocus.com/bid/42585
http://www.vupen.com/english/advisories/2010/2430
http://www.vupen.com/english/advisories/2011/0298
https://bugzilla.redhat.com/show_bug.cgi?id=625699
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b75c4973ce779520b9d1e392483207d6f842cde
http://jon.oberheide.org/files/i-can-haz-modharden.c
http://lists.fedoraproject.org/pipermail/package-announce/2010-September/046947.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://secunia.com/advisories/41512
http://www.debian.org/security/2010/dsa-2094
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.53
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.21
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34.6
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.4
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198
http://www.openwall.com/lists/oss-security/2010/08/20/2
http://www.securityfocus.com/bid/42585
http://www.vupen.com/english/advisories/2010/2430
http://www.vupen.com/english/advisories/2011/0298
https://bugzilla.redhat.com/show_bug.cgi?id=625699