CVE-2010-3078

EUVD-2010-3080
The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
𝑥
≤ 2.6.35.4
linuxlinux_kernel
2.6.36
linuxlinux_kernel
2.6.36:rc1
linuxlinux_kernel
2.6.36:rc2
linuxlinux_kernel
2.6.36:rc3
opensuseopensuse
11.1
opensuseopensuse
11.3
canonicalubuntu_linux
6.06
canonicalubuntu_linux
8.04
canonicalubuntu_linux
9.04
canonicalubuntu_linux
9.10
canonicalubuntu_linux
10.04
canonicalubuntu_linux
10.10
vmwareesx
4.0
vmwareesx
4.1
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
dapper
dne
hardy
Fixed 2.6.24-28.80
released
jaunty
Fixed 2.6.28-19.66
released
karmic
Fixed 2.6.31-22.67
released
lucid
Fixed 2.6.32-25.45
released
maverick
not-affected
linux-ec2
dapper
dne
hardy
dne
karmic
Fixed 2.6.31-307.21
released
lucid
Fixed 2.6.32-309.18
released
maverick
ignored
linux-fsl-imx51
dapper
dne
hardy
dne
karmic
Fixed 2.6.31-112.30
released
lucid
Fixed 2.6.31-608.22
released
maverick
dne
linux-lts-backport-maverick
dapper
dne
hardy
dne
karmic
dne
lucid
Fixed 2.6.35-25.44~lucid1
released
maverick
dne
linux-mvl-dove
dapper
dne
hardy
dne
karmic
ignored
lucid
Fixed 2.6.32-216.33
released
maverick
Fixed 2.6.32-416.33
released
linux-source-2.6.15
dapper
not-affected
hardy
dne
jaunty
dne
karmic
dne
lucid
dne
maverick
dne
Common Weakness Enumeration
References
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://secunia.com/advisories/41284
http://secunia.com/advisories/41512
http://secunia.com/advisories/42890
http://secunia.com/advisories/46397
http://securitytracker.com/id?1024418
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4
http://www.linux.sgi.com/archives/xfs-masters/2010-09/msg00002.html
http://www.openwall.com/lists/oss-security/2010/09/07/1
http://www.openwall.com/lists/oss-security/2010/09/07/12
http://www.redhat.com/support/errata/RHSA-2010-0839.html
http://www.redhat.com/support/errata/RHSA-2011-0007.html
http://www.securityfocus.com/archive/1/520102/100/0/threaded
http://www.securityfocus.com/bid/43022
http://www.ubuntu.com/usn/USN-1000-1
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
http://www.vupen.com/english/advisories/2010/2430
http://www.vupen.com/english/advisories/2011/0298
https://bugzilla.redhat.com/show_bug.cgi?id=630804
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://secunia.com/advisories/41284
http://secunia.com/advisories/41512
http://secunia.com/advisories/42890
http://secunia.com/advisories/46397
http://securitytracker.com/id?1024418
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4
http://www.linux.sgi.com/archives/xfs-masters/2010-09/msg00002.html
http://www.openwall.com/lists/oss-security/2010/09/07/1
http://www.openwall.com/lists/oss-security/2010/09/07/12
http://www.redhat.com/support/errata/RHSA-2010-0839.html
http://www.redhat.com/support/errata/RHSA-2011-0007.html
http://www.securityfocus.com/archive/1/520102/100/0/threaded
http://www.securityfocus.com/bid/43022
http://www.ubuntu.com/usn/USN-1000-1
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
http://www.vupen.com/english/advisories/2010/2430
http://www.vupen.com/english/advisories/2011/0298
https://bugzilla.redhat.com/show_bug.cgi?id=630804