CVE-2010-3081

Published: Sep 24, 2010Modified: Apr 29, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

Affected (9)

Products: Linux: Linux Kernel · Vmware: Esx · Suse: Suse Linux Enterprise Desktop, Suse Linux Enterprise Server

1 product

1 product

2 products

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 2.6.35.4
Linux Linux Kernel	Version 2.6.36
Linux Linux Kernel	Version 2.6.36 rc1
Linux Linux Kernel	Version 2.6.36 rc2
Linux Linux Kernel	Version 2.6.36 rc3

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Vmware Esx	Version 4.0
Vmware Esx	Version 4.1

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Suse Suse Linux Enterprise Desktop	Version 11 sp1
Suse Suse Linux Enterprise Server	Version 11 sp1

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (56)

http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html

Source: secalert@redhat.com

Broken Link

http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html

Source: secalert@redhat.com

Broken Link

http://blog.ksplice.com/2010/09/cve-2010-3081/

Source: secalert@redhat.com

Broken Link

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c41d68a513c71e35a14f66d71782d27a79a81ea6

Source: secalert@redhat.com

http://isc.sans.edu/diary.html?storyid=9574

Source: secalert@redhat.com

PatchThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://marc.info/?l=oss-security&m=128461522230211&w=2

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://secunia.com/advisories/42384

Source: secalert@redhat.com

Broken Link

http://secunia.com/advisories/43315

Source: secalert@redhat.com

Broken Link

http://sota.gen.nz/compat1/

Source: secalert@redhat.com

Broken Link

http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.log

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2010:198

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2010:214

Source: secalert@redhat.com

Broken Link

http://www.mandriva.com/security/advisories?name=MDVSA-2010:247

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2010-0758.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2010-0842.html

Source: secalert@redhat.com

Broken Link

http://www.redhat.com/support/errata/RHSA-2010-0882.html

Source: secalert@redhat.com

Broken Link

http://www.securityfocus.com/archive/1/514938/30/30/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/516397/100/0/threaded

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.vmware.com/security/advisories/VMSA-2010-0017.html

Source: secalert@redhat.com

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

Source: secalert@redhat.com

Third Party Advisory

http://www.vupen.com/english/advisories/2010/3083

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2010/3117

Source: secalert@redhat.com

Broken Link

http://www.vupen.com/english/advisories/2011/0298

Source: secalert@redhat.com

Broken Link

https://access.redhat.com/kb/docs/DOC-40265

Source: secalert@redhat.com

ExploitPatchThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=634457

Source: secalert@redhat.com

Issue TrackingPatchThird Party Advisory

http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html