CVE-2010-3078

Published: Sep 21, 2010Modified: Apr 29, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via an ioctl call.

Affected (17)

Products: Linux: Linux Kernel · Opensuse: Opensuse · Suse: Suse Linux Enterprise Desktop, Suse Linux Enterprise Server · +2 more

Show all products

Linux: Linux Kernel · Opensuse: Opensuse · Suse: Suse Linux Enterprise Desktop, Suse Linux Enterprise Server · Canonical: Ubuntu Linux · Vmware: Esx

1 product

1 product

2 products

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 2.6.35.4
Linux Linux Kernel	Version 2.6.36
Linux Linux Kernel	Version 2.6.36 rc1
Linux Linux Kernel	Version 2.6.36 rc2
Linux Linux Kernel	Version 2.6.36 rc3

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.1
Opensuse Opensuse	Version 11.3
Suse Suse Linux Enterprise Desktop	Version 11 sp1
Suse Suse Linux Enterprise Server	Version 11 sp1

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 10.04
Canonical Ubuntu Linux	Version 10.10
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 9.04
Canonical Ubuntu Linux	Version 9.10

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Esx	Version 4.0
Vmware Esx	Version 4.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (46)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://secunia.com/advisories/41284

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/41512

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/42890

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/46397

Source: secalert@redhat.com

Broken Link

http://securitytracker.com/id?1024418

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4

Source: secalert@redhat.com

Broken Link

http://www.linux.sgi.com/archives/xfs-masters/2010-09/msg00002.html

Source: secalert@redhat.com

Broken Link

http://www.openwall.com/lists/oss-security/2010/09/07/1

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2010/09/07/12

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2010-0839.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2011-0007.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/520102/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/43022

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/USN-1000-1

Source: secalert@redhat.com

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2011-0012.html

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/2430

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2011/0298

Source: secalert@redhat.com

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=630804

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a122eb2fdfd78b58c6dd992d6f4b1aaef667eef9