5.5

CVE-2010-2942

The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version <= 2.6.35.13
Linux ≫ Linux Kernel Version2.6.36 Update-
Linux ≫ Linux Kernel Version2.6.36 Updaterc1
Canonical ≫ Ubuntu Linux Version6.06
Canonical ≫ Ubuntu Linux Version8.04
Canonical ≫ Ubuntu Linux Version9.04
Canonical ≫ Ubuntu Linux Version9.10
Canonical ≫ Ubuntu Linux Version10.04 SwEdition-
Canonical ≫ Ubuntu Linux Version10.10
Opensuse ≫ Opensuse Version11.1
Opensuse ≫ Opensuse Version11.3
Suse ≫ Suse Linux Enterprise Desktop Version10 Updatesp3
Suse ≫ Suse Linux Enterprise Desktop Version11 Update-
Suse ≫ Suse Linux Enterprise Desktop Version11 Updatesp1
Suse ≫ Suse Linux Enterprise Server Version10 Updatesp3
Suse ≫ Suse Linux Enterprise Server Version11 Update-
Suse ≫ Suse Linux Enterprise Server Version11 Updatesp1
Avaya ≫ Aura Presence Services Version6.0
Avaya ≫ Aura Presence Services Version6.1
Avaya ≫ Aura Presence Services Version6.1.1
Avaya ≫ Aura Session Manager Version1.1
Avaya ≫ Aura Session Manager Version5.2
Avaya ≫ Aura Session Manager Version6.0
Avaya ≫ Aura System Manager Version5.2
Avaya ≫ Aura System Manager Version6.0
Avaya ≫ Aura System Manager Version6.1
Avaya ≫ Aura System Manager Version6.1.1
Avaya ≫ Aura System Platform Version1.1
Avaya ≫ Aura System Platform Version6.0 Update-
Avaya ≫ Aura System Platform Version6.0 Updatesp1
Avaya ≫ Iq Version5.0
Avaya ≫ Iq Version5.1
Avaya ≫ Voice Portal Version5.0
Avaya ≫ Voice Portal Version5.1 Update-
Avaya ≫ Voice Portal Version5.1 Updatesp1
VMware ≫ Esx Version4.0
VMware ≫ Esx Version4.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.335
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

http://www.redhat.com/support/errata/RHSA-2010-0771.html
Broken Link
http://secunia.com/advisories/46397
Broken Link
http://support.avaya.com/css/P8/documents/100113326
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0723.html
Broken Link
http://www.securityfocus.com/archive/1/520102/100/0/threaded
Third Party Advisory
VDB Entry
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
Third Party Advisory
Mailing List
http://www.ubuntu.com/usn/USN-1000-1
Third Party Advisory
http://www.vupen.com/english/advisories/2011/0298
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
Third Party Advisory
Mailing List
http://secunia.com/advisories/41512
Broken Link
http://www.vupen.com/english/advisories/2010/2430
Broken Link
http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=1c40be12f7d8ca1d387510d39787b12e512a7ce8
http://patchwork.ozlabs.org/patch/61857/
Patch
Third Party Advisory
Mailing List
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc2
Broken Link
http://www.openwall.com/lists/oss-security/2010/08/18/1
Patch
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2010/08/19/4
Patch
Third Party Advisory
Mailing List
http://www.redhat.com/support/errata/RHSA-2010-0779.html
Broken Link
http://www.securityfocus.com/bid/42529
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=624903
Patch
Third Party Advisory
Issue Tracking