2.1

CVE-2010-3861

The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478.

Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 2.6.36
Opensuse ≫ Opensuse Version11.2
Opensuse ≫ Opensuse Version11.3
Suse ≫ Linux Enterprise Desktop Version11 Updatesp1
Suse ≫ Linux Enterprise Real Time Extension Version11 Updatesp1
Suse ≫ Linux Enterprise Server Version11 Updatesp1
Canonical ≫ Ubuntu Linux Version9.10
Canonical ≫ Ubuntu Linux Version10.04 SwEdition-
Canonical ≫ Ubuntu Linux Version10.10
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.05% 0.131
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://openwall.com/lists/oss-security/2010/10/25/4
Patch
Third Party Advisory
Mailing List
http://openwall.com/lists/oss-security/2010/10/26/1
Patch
Third Party Advisory
Mailing List
http://www.securityfocus.com/bid/44427
Third Party Advisory
VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=646725
Third Party Advisory
Issue Tracking