CVE-2010-2521: Buffer Overflow

First published: Wed Jul 07 2010(Updated: )

Description of problem: When read_buf is called to move over to the next page in the pagelist of an NFSv4 request, it sets argp-&gt;end to essentially a random number, certainly not an address within the page which argp-&gt;p now points to. So subsequent calls to READ_BUF will think there is much more than a page of spare space (the cast to u32 ensures an unsigned comparison) so we can expect to fall off the end of the second page. We never encountered this in testing because typically the only operations which use more than two pages are write-like operations, which have their own decoding logic. Something like a getattr after a write may cross a page boundary, but it would be very unusual for it to cross another boundary after that. Upstream commit: <a href="http://git.kernel.org/linus/2bc3c1179c781b359d4f2f3439cb3df72afc17fc">http://git.kernel.org/linus/2bc3c1179c781b359d4f2f3439cb3df72afc17fc</a>

Credit: secalert@redhat.com secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-historical
• collector/nvd-index
• agent/type
• collector/launchpad-cve
• source/Launchpad
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2010-2521
• agent/first-publish-date
• agent/author
• collector/security-tracker-debian
• source/Debian
• agent/software-canonical-lookup
• agent/severity
• agent/remedy
• agent/weakness
• collector/mitre-cve
• source/MITRE
• collector/usn-cve
• source/Ubuntu
• agent/references
• agent/softwarecombine
• agent/tags
• agent/description
• agent/event
• collector/nvd-cve
• source/NVD
• agent/last-modified-date
• agent/trending
• vendor/linux
• canonical/linux linux kernel
• version/linux linux kernel/2.6.11
• version/linux linux kernel/2.6.23.4
• version/linux linux kernel/2.6.16.16
• version/linux linux kernel/2.6.18.7
• version/linux linux kernel/2.6.17.12
• version/linux linux kernel/2.6.16.9
• version/linux linux kernel/2.6.17.9
• version/linux linux kernel/2.6.11.2
• version/linux linux kernel/2.6.5
• version/linux linux kernel/2.6.15.3
• version/linux linux kernel/2.6.11.10
• version/linux linux kernel/2.6.1
• version/linux linux kernel/2.6.16.6
• version/linux linux kernel/2.6.16.8
• version/linux linux kernel/2.6.33-rc6
• version/linux linux kernel/2.6.22.4
• version/linux linux kernel/2.6.14.7
• version/linux linux kernel/2.6.13
• version/linux linux kernel/2.6.17.2
• version/linux linux kernel/2.6.13.3
• version/linux linux kernel/2.6.11.8
• version/linux linux kernel/2.6.23.7
• version/linux linux kernel/2.6.17.8
• version/linux linux kernel/2.6.14.4
• version/linux linux kernel/2.6.14
• version/linux linux kernel/2.6.17.4
• version/linux linux kernel/2.6.16.18
• version/linux linux kernel/2.6.17.14
• version/linux linux kernel/2.6.10
• version/linux linux kernel/2.6.14.3
• version/linux linux kernel/2.6.34-rc2
• version/linux linux kernel/2.6.24-rc3
• version/linux linux kernel/2.6.18.3
• version/linux linux kernel/2.6.11.6
• version/linux linux kernel/2.6.11.11
• version/linux linux kernel/2.6.16.13
• version/linux linux kernel/2.6.3
• version/linux linux kernel/2.6.32
• version/linux linux kernel/2.6.16.4
• version/linux linux kernel/2.6.17.3
• version/linux linux kernel/2.6.32.3
• version/linux linux kernel/2.6.22
• version/linux linux kernel/2.6.4
• version/linux linux kernel/2.6.16.15
• version/linux linux kernel/2.6.15.6
• version/linux linux kernel/2.6.24-rc5
• version/linux linux kernel/2.6.34-rc1
• version/linux linux kernel/2.6.15.1
• version/linux linux kernel/2.6.11.5
• version/linux linux kernel/2.6.18.4
• version/linux linux kernel/2.6.33-rc1
• version/linux linux kernel/2.6.16.1
• version/linux linux kernel/2.6.18.1
• version/linux linux kernel/2.6.23.1
• version/linux linux kernel/2.6.2
• version/linux linux kernel/2.6.14.5
• version/linux linux kernel/2.6.13.2
• version/linux linux kernel/2.6.17.5
• version/linux linux kernel/2.6.24-rc4
• version/linux linux kernel/2.6.18.5
• version/linux linux kernel/2.6.33.2
• version/linux linux kernel/2.6.13.5
• version/linux linux kernel/2.6.17
• version/linux linux kernel/2.6.16.11
• version/linux linux kernel/2.6.16.14
• version/linux linux kernel/2.6.33-rc2
• version/linux linux kernel/2.6.16.25
• version/linux linux kernel/2.6.16.21
• version/linux linux kernel/2.6.8
• version/linux linux kernel/2.6.16.28
• version/linux linux kernel/2.6.17.10
• version/linux linux kernel/2.6.14.1
• version/linux linux kernel/2.6.16.23
• version/linux linux kernel/2.6.33.1
• version/linux linux kernel/2.6.12.5
• version/linux linux kernel/2.6.15.7
• version/linux linux kernel/2.6.22.7
• version/linux linux kernel/2.6.16.3
• version/linux linux kernel/2.6.24-rc1
• version/linux linux kernel/2.6.14.6
• version/linux linux kernel/2.6.12.1
• version/linux linux kernel/2.6.11.9
• version/linux linux kernel/2.6.33
• version/linux linux kernel/2.6.17.1
• version/linux linux kernel/2.6.0
• version/linux linux kernel/2.6.13.4
• version/linux linux kernel/2.6.23-rc2
• version/linux linux kernel/2.6.22.6
• version/linux linux kernel/2.6.23.3
• version/linux linux kernel/2.6.18.8
• version/linux linux kernel/2.6.22.3
• version/linux linux kernel/2.6.12.2
• version/linux linux kernel/2.6.16.31
• version/linux linux kernel/2.6.16.26
• version/linux linux kernel/2.6.18.2
• version/linux linux kernel/2.6.16.29
• version/linux linux kernel/2.6.23-rc1
• version/linux linux kernel/2.6.16
• version/linux linux kernel/2.6.15.2
• version/linux linux kernel/2.6.16.22
• version/linux linux kernel/2.6.17.11
• version/linux linux kernel/2.6.16.10
• version/linux linux kernel/2.6.12.4
• version/linux linux kernel/2.6.11.3
• version/linux linux kernel/2.6.33-rc3
• version/linux linux kernel/2.6.16.24
• version/linux linux kernel/2.6.23
• version/linux linux kernel/2.6.12.3
• version/linux linux kernel/2.6.23.2
• version/linux linux kernel/2.6.34-rc3
• version/linux linux kernel/2.6.7
• version/linux linux kernel/2.6.32.4
• version/linux linux kernel/2.6.34
• version/linux linux kernel/2.6.16.30
• version/linux linux kernel/2.6.15.4
• version/linux linux kernel/2.6.24-rc2
• version/linux linux kernel/2.6.16.17
• version/linux linux kernel/2.6.16.12
• version/linux linux kernel/2.6.16.27
• version/linux linux kernel/2.6.12.6
• version/linux linux kernel/2.6.17.7
• version/linux linux kernel/2.6.11.7
• version/linux linux kernel/2.6.16.2
• version/linux linux kernel/2.6.18.6
• version/linux linux kernel/2.6.15
• version/linux linux kernel/2.6.33-rc4
• version/linux linux kernel/2.6.34-rc4
• version/linux linux kernel/2.6.23.5
• version/linux linux kernel/2.6.32.2
• version/linux linux kernel/2.6.17.6
• version/linux linux kernel/2.6.23.6
• version/linux linux kernel/2.6.16.7
• version/linux linux kernel/2.6.32.1
• version/linux linux kernel/2.6.17.13
• version/linux linux kernel/2.6.22.2
• version/linux linux kernel/2.6.8.1
• version/linux linux kernel/2.6.22.5
• version/linux linux kernel/2.6.16.5
• version/linux linux kernel/2.6.11.4
• version/linux linux kernel/2.6.16.19
• version/linux linux kernel/2.6.11.12
• version/linux linux kernel/2.6.16.20
• version/linux linux kernel/2.6.15.5
• version/linux linux kernel/2.6.11.1
• version/linux linux kernel/2.6.33-rc5
• version/linux linux kernel/2.6.9
• version/linux linux kernel/2.6.13.1
• version/linux linux kernel/2.6.6
• version/linux linux kernel/2.6.12
• package-manager/debian