CVE-2010-2946

Published: Sep 29, 2010Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

fs/jfs/xattr.c in the Linux kernel before 2.6.35.2 does not properly handle a certain legacy format for storage of extended attributes, which might allow local users by bypass intended xattr namespace restrictions via an "os2." substring at the beginning of a name.

Affected (7)

Products: Linux: Linux Kernel · Canonical: Ubuntu Linux

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 2.6.35.2

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (36)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=aca0fa34bdaba39bfddddba8ca70dba4782e8fe6

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/41321

Source: secalert@redhat.com

Third Party Advisory

http://secunia.com/advisories/43291

Source: secalert@redhat.com

Third Party Advisory

http://www.kernel.org/pub/linux/kernel/v2.4/ChangeLog-2.4.37.10

Source: secalert@redhat.com

Vendor Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.51

Source: secalert@redhat.com

Vendor Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.2

Source: secalert@redhat.com

Vendor Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2011:051

Source: secalert@redhat.com

Third Party Advisory

http://www.openwall.com/lists/oss-security/2010/08/20/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/08/20/11

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/42589

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1000-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0298

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0375

Source: secalert@redhat.com

Third Party Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=aca0fa34bdaba39bfddddba8ca70dba4782e8fe6