5.5

CVE-2010-2942

The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version <= 2.6.35.13
Linux ≫ Linux Kernel Version 2.6.36 Update -
Linux ≫ Linux Kernel Version 2.6.36 Update rc1
Canonical ≫ Ubuntu Linux Version 6.06
Canonical ≫ Ubuntu Linux Version 8.04
Canonical ≫ Ubuntu Linux Version 9.04
Canonical ≫ Ubuntu Linux Version 9.10
Canonical ≫ Ubuntu Linux Version 10.04 SwEdition -
Canonical ≫ Ubuntu Linux Version 10.10
Opensuse ≫ Opensuse Version 11.1
Opensuse ≫ Opensuse Version 11.3
Suse ≫ Suse Linux Enterprise Desktop Version 10 Update sp3
Suse ≫ Suse Linux Enterprise Desktop Version 11 Update -
Suse ≫ Suse Linux Enterprise Desktop Version 11 Update sp1
Suse ≫ Suse Linux Enterprise Server Version 10 Update sp3
Suse ≫ Suse Linux Enterprise Server Version 11 Update -
Suse ≫ Suse Linux Enterprise Server Version 11 Update sp1
Avaya ≫ Aura Presence Services Version 6.0
Avaya ≫ Aura Presence Services Version 6.1
Avaya ≫ Aura Presence Services Version 6.1.1
Avaya ≫ Aura Session Manager Version 1.1
Avaya ≫ Aura Session Manager Version 5.2
Avaya ≫ Aura Session Manager Version 6.0
Avaya ≫ Aura System Manager Version 5.2
Avaya ≫ Aura System Manager Version 6.0
Avaya ≫ Aura System Manager Version 6.1
Avaya ≫ Aura System Manager Version 6.1.1
Avaya ≫ Aura System Platform Version 1.1
Avaya ≫ Aura System Platform Version 6.0 Update -
Avaya ≫ Aura System Platform Version 6.0 Update sp1
Avaya ≫ Iq Version 5.0
Avaya ≫ Iq Version 5.1
Avaya ≫ Voice Portal Version 5.0
Avaya ≫ Voice Portal Version 5.1 Update -
Avaya ≫ Voice Portal Version 5.1 Update sp1
VMware ≫ Esx Version 4.0
VMware ≫ Esx Version 4.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.42% 0.335
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

http://www.redhat.com/support/errata/RHSA-2010-0771.html
Broken Link
http://secunia.com/advisories/46397
Broken Link
http://support.avaya.com/css/P8/documents/100113326
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2010-0723.html
Broken Link
http://www.securityfocus.com/archive/1/520102/100/0/threaded
Third Party Advisory
VDB Entry
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
Third Party Advisory
Mailing List
http://www.ubuntu.com/usn/USN-1000-1
Third Party Advisory
http://www.vupen.com/english/advisories/2011/0298
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html
Third Party Advisory
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
Third Party Advisory
Mailing List
http://secunia.com/advisories/41512
Broken Link
http://www.vupen.com/english/advisories/2010/2430
Broken Link
http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=1c40be12f7d8ca1d387510d39787b12e512a7ce8
http://patchwork.ozlabs.org/patch/61857/
Patch
Third Party Advisory
Mailing List
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc2
Broken Link
http://www.openwall.com/lists/oss-security/2010/08/18/1
Patch
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2010/08/19/4
Patch
Third Party Advisory
Mailing List
http://www.redhat.com/support/errata/RHSA-2010-0779.html
Broken Link
http://www.securityfocus.com/bid/42529
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=624903
Patch
Third Party Advisory
Issue Tracking