CVE-2010-2240: Code Injection
Description of problem: When an application has a stack overflow, the stack could silently overwrite other memory mapped area instead of causing a segmentation fault.
Acknowledgements:
Red Hat would like to thank the X.Org security team for reporting this issue. Upstream acknowledges Rafal Wojtczuk as the original reporter.
Other sources
The doanonymouspage function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-2240?
CVE-2010-2240 is classified as a moderate severity vulnerability due to the risk of memory corruption.
How do I fix CVE-2010-2240?
To address CVE-2010-2240, upgrade to the fixed kernel versions specified in the security advisory.
Which systems are affected by CVE-2010-2240?
CVE-2010-2240 affects various versions of the Linux kernel, particularly those prior to 2.6.32.19.
What type of attack does CVE-2010-2240 enable?
CVE-2010-2240 may allow attackers to exploit memory issues which could lead to remote code execution.
Is there a workaround for CVE-2010-2240?
Currently, the best mitigation strategy for CVE-2010-2240 is to apply the security updates provided by the vendor.