medium
4.9
CWE
399
Advisory Published
CVE Published
Updated

CVE-2010-0410

First published: Thu Feb 04 2010(Updated: )

Description of problem: A problem was found in the drivers/connector/connector.c code where users could send/allocate arbitrary amounts of NETLINK_CONNECTOR messages to the kernel, causing OOM condition, killing selected processes or halting the system. This is fixed in mainline commit f98bfbd78c37c5946cc53089da32a5f741efdeb7 by removing the code. commit f98bfbd78c37c5946cc53089da32a5f741efdeb7 Author: Evgeniy Polyakov <zbr> Date: Tue Feb 2 15:58:48 2010 -0800 connector: Delete buggy notification code. On Tue, Feb 02, 2010 at 02:57:14PM -0800, Greg KH (gregkh) wrote: > > There are at least two ways to fix it: using a big cannon and a small > > one. The former way is to disable notification registration, since it is > > not used by anyone at all. Second way is to check whether calling > > process is root and its destination group is -1 (kind of priveledged > > one) before command is dispatched to workqueue. > > Well if no one is using it, removing it makes the most sense, right? > > No objection from me, care to make up a patch either way for this? Getting it is not used, let's drop support for notifications about (un)registered events from connector. Another option was to check credentials on receiving, but we can always restore it without bugs if needed, but genetlink has a wider code base and none complained, that userspace can not get notification when some other clients were (un)registered. Kudos for Sebastian Krahmer <krahmer>, who found a bug in the code. Signed-off-by: Evgeniy Polyakov <zbr> Acked-by: Greg Kroah-Hartman <gregkh> Signed-off-by: David S. Miller <davem> Acknowledgements: Red Hat would like to thank Sebastian Krahmer for reporting this issue.

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Linux kernel<2.6.32.8
Debian=5.0
Debian=4.0
Ubuntu Linux=6.06
Ubuntu Linux=9.04
Ubuntu Linux=8.04
Ubuntu Linux=8.10
Ubuntu Linux=9.10
Linux Kernel<2.6.32.8
Ubuntu=6.06
Ubuntu=8.04
Ubuntu=8.10
Ubuntu=9.04
Ubuntu=9.10

Remedy

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.8

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2010-0410?

    CVE-2010-0410 is considered a medium severity vulnerability due to its potential to cause out-of-memory (OOM) conditions.

  • How do I fix CVE-2010-0410?

    To fix CVE-2010-0410, you should update your Linux kernel to version 2.6.32.9 or later.

  • Which software versions are affected by CVE-2010-0410?

    CVE-2010-0410 affects several versions of the Linux kernel prior to 2.6.32.9, as well as specific Debian and Ubuntu releases.

  • What type of attack does CVE-2010-0410 allow?

    CVE-2010-0410 allows attackers to send excessive NETLINK_CONNECTOR messages to the kernel, potentially leading to system instability.

  • Is CVE-2010-0410 present in modern kernels?

    No, CVE-2010-0410 is not present in modern Linux kernels as it has been addressed in later versions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203