CVE-2010-2226: Infoleak
Description of problem: User "foo" can use the SWAPEXT ioctl to swap a write-only file owned by user "bar" into a file owned by "foo" and subsequently reading it. It does so by checking that the file descriptors passed to the ioctl are also opened for reading.
References: http://archives.free.net.ph/message/20100616.130710.301704aa.en.html http://archives.free.net.ph/message/20100616.135735.40f53a32.en.html
Other sources
The xfsswapext function in fs/xfs/xfsdfrag.c in the Linux kernel before 2.6.35 does not properly check the file descriptors passed to the SWAPEXT ioctl, which allows local users to leverage write access and obtain read access by swapping one file into another file.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2226?
CVE-2010-2226 is classified as a high-severity vulnerability that allows unauthorized file access.
How do I fix CVE-2010-2226?
To fix CVE-2010-2226, update your Linux kernel to a version later than 2.6.35.
Who is affected by CVE-2010-2226?
CVE-2010-2226 affects users of Linux Kernel versions up to 2.6.35, as well as specific distributions such as Debian, Ubuntu, and SUSE.
What types of systems are vulnerable to CVE-2010-2226?
Systems running vulnerable versions of the Linux Kernel, including Debian Linux 5.0 and specific versions of Ubuntu and SUSE, are susceptible to CVE-2010-2226.
What exploit is associated with CVE-2010-2226?
CVE-2010-2226 is exploited through the SWAPEXT ioctl, allowing a user to access files they should not have permission to read.