CVE-2010-2955

Published: Sep 8, 2010Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.

Affected (14)

Products: Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Real Time Extension, Linux Enterprise Server · +1 more

Show all products

Linux: Linux Kernel · Opensuse: Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Real Time Extension, Linux Enterprise Server · Canonical: Ubuntu Linux

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Real Time Extension

Linux Enterprise Server

Canonical

1 product

Ubuntu Linux

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Before 2.6.36
Linux Linux Kernel	Version 2.6.36
Linux Linux Kernel	Version 2.6.36 rc1
Linux Linux Kernel	Version 2.6.36 rc2

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Suse Linux Enterprise Desktop	Version 11
Suse Linux Enterprise Real Time Extension	Version 11 sp1
Suse Linux Enterprise Server	Version 11

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Related CWEs

CWE-193

Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

References (36)

http://forums.grsecurity.net/viewtopic.php?f=3&t=2290

Source: secalert@redhat.com

Third Party Advisory

http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git%3Ba=commit%3Bh=42da2f948d949efd0111309f5827bf0298bcc9a4

Source: secalert@redhat.com

http://grsecurity.net/~spender/wireless-infoleak-fix2.patch

Source: secalert@redhat.com

Broken Link

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lkml.org/lkml/2010/8/27/413

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://lkml.org/lkml/2010/8/30/127

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://lkml.org/lkml/2010/8/30/146

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://lkml.org/lkml/2010/8/30/351

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://secunia.com/advisories/41245

Source: secalert@redhat.com

Third Party Advisory

http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.36-rc3-next-20100831.bz2

Source: secalert@redhat.com

Broken Link

http://www.openwall.com/lists/oss-security/2010/08/31/1

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0771.html

Source: secalert@redhat.com

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0842.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/42885

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1000-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2011/0298

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=628434

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://forums.grsecurity.net/viewtopic.php?f=3&t=2290