CVE-2010-2492: Buffer Overflow
Buffer overflow in the ecryptfsuidhash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
Other sources
Description of problem: The function ecryptfsuidhash wrongly assumes that the second parameter to hashlong() is the number of hash buckets instead of the number of hash bits. This patch fixes that and renames the variable ecryptfshashbuckets to ecryptfshashbits to make it clearer.
Acknowledgements:
Red Hat would like to thank Andre Osterhues for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2492?
CVE-2010-2492 is considered to have high severity due to its potential to allow local users to gain privileges or cause a system crash.
How do I fix CVE-2010-2492?
To fix CVE-2010-2492, you should upgrade to Linux kernel version 2.6.35 or later, or apply any relevant patches provided by your software vendor.
Which software is affected by CVE-2010-2492?
CVE-2010-2492 affects the Linux kernel versions prior to 2.6.35 and certain versions of VMware ESX and Avaya Aura products.
What vulnerabilities does CVE-2010-2492 exploit?
CVE-2010-2492 exploits a buffer overflow vulnerability in the eCryptfs subsystem,
Who can be impacted by CVE-2010-2492?
Local users can be impacted by CVE-2010-2492, as it may allow them to gain elevated privileges or cause a denial of service.