CVE-2010-2537: High severity linux kernel vulnerability
Description of problem: 1. CVE-2010-2537 - The BTRFSIOCCLONE and BTRFSIOCCLONERANGE ioctls should check whether the donor file is append-only before writing to it.
2. CVE-2010-2538 - The BTRFSIOCCLONERANGE ioctl appears to have an integer overflow that allows a user to specify an out-of-bounds range to copy from the source file (if off + len wraps around).
Upstream commit: http://git.kernel.org/linus/2ebc3464781ad24474abcbd2274e6254689853b5
Reference: https://btrfs.wiki.kernel.org/index.php/MainPage
The kernel in Red Hat Enterprise Linux 6 has support for Btrfs by default.
Other sources
The btrfsioctlclone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFSIOCCLONE or (2) BTRFSIOCCLONERANGE ioctl call that specifies this file as a donor.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2537?
CVE-2010-2537 has a moderate severity level due to potential data loss risks when handling append-only files.
How do I fix CVE-2010-2537?
To fix CVE-2010-2537, update your Linux kernel to a version that incorporates the necessary checks for append-only files.
Which versions are affected by CVE-2010-2537?
CVE-2010-2537 affects Linux kernel versions prior to 2.6.35 and specific versions of Ubuntu and SUSE Linux.
What are the exploits associated with CVE-2010-2537?
CVE-2010-2537 may allow an attacker to modify a file that should be append-only, leading to unauthorized data changes.
Can CVE-2010-2537 be exploited remotely?
CVE-2010-2537 is not known to be exploitable remotely, as it requires local access to manipulate files directly.