CVE-2010-2942

moderate-risk

Published 2010-09-21

The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.

Do I need to act?

0.06% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.5/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Linux Kernel

Ubuntu Linux

Suse Linux Enterprise Desktop

Suse Linux Enterprise Server

Aura Presence Services

Aura Session Manager

Aura System Manager

Aura System Platform

Affected Vendors

Avaya Suse Linux Vmware Opensuse Canonical

References (46)

http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=1c40b...

Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00004.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html

Mailing List http://patchwork.ozlabs.org/patch/61857/

Broken Link http://secunia.com/advisories/41512

Broken Link http://secunia.com/advisories/46397

Third Party Advisory http://support.avaya.com/css/P8/documents/100113326

Broken Link http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc2

Mailing List http://www.openwall.com/lists/oss-security/2010/08/18/1

Mailing List http://www.openwall.com/lists/oss-security/2010/08/19/4

Broken Link http://www.redhat.com/support/errata/RHSA-2010-0723.html

Broken Link http://www.redhat.com/support/errata/RHSA-2010-0771.html

Broken Link http://www.redhat.com/support/errata/RHSA-2010-0779.html

Third Party Advisory http://www.securityfocus.com/archive/1/520102/100/0/threaded

Third Party Advisory http://www.securityfocus.com/bid/42529

Third Party Advisory http://www.ubuntu.com/usn/USN-1000-1

Third Party Advisory http://www.vmware.com/security/advisories/VMSA-2011-0012.html

and 26 more references

/ 100

moderate-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 24/34 · High