CVE-2010-0302: Use After Free
Description of problem: CVE-2009-3553 (bug #530111) has not been completely fixed.
Version-Release number of selected component (if applicable): Versions known to be affected:
cups-1.3.7-11.el54.5 (RHEL-5.4.z) cups-1.3.7-16.el5 (RHEL-5)
Additional info: The cause is that the cupsdDoSelect() function uses one of several implementations depending on the underlying select/poll capabilities of the operating system. For kqueue and epoll implementations, cupsdRemoveSelect() does not immediately decrease the reference count for the file descriptor and instead adds it to the cupsdinactivefds array. File descriptors in that array are finally dereferenced in cupsdStopSelect() (i.e. program termination).
In Red Hat Enterprise Linux, the epoll implementation is used.
The previous fix for CVE-2009-3553 was to check that another reference was held for the file descriptor before calling the writecb function; however, that will always be the case for both the epoll and kqueue implementations.
The correct fix is to check whether the file descriptor is in the cupsdinactivefds array before calling the writecb function.
Other sources
Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4, when kqueue or epoll is used, allows remote attackers to cause a denial of service (daemon crash or hang) via a client disconnection during listing of a large number of print jobs, related to improperly maintaining a reference count. NOTE: some of these details are obtained from third party information. NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3553.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0302?
CVE-2010-0302 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2010-0302?
To mitigate CVE-2010-0302, upgrade to CUPS version 1.4.4 or later.
Which versions are affected by CVE-2010-0302?
CVE-2010-0302 affects CUPS versions prior to 1.4.4, including 1.3.7 to 1.4.1.
What is the impact of CVE-2010-0302?
The impact of CVE-2010-0302 is a denial of service that may crash or hang the CUPS daemon.
Who can exploit CVE-2010-0302?
CVE-2010-0302 can be exploited by remote attackers who have access to connect to the CUPS service.