CVE-2010-2946: Input Validation
fs/jfs/xattr.c in the Linux kernel before 2.6.35.2 does not properly handle a certain legacy format for storage of extended attributes, which might allow local users by bypass intended xattr namespace restrictions via an "os2." substring at the beginning of a name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 2.6.35.2
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2946?
CVE-2010-2946 is considered a moderate vulnerability that could allow local users to bypass extended attribute namespace restrictions.
How do I fix CVE-2010-2946?
To remediate CVE-2010-2946, you should upgrade your Linux kernel to version 2.6.35.2 or later.
Which versions of the Linux kernel are affected by CVE-2010-2946?
CVE-2010-2946 affects Linux kernels prior to version 2.6.35.2.
Can CVE-2010-2946 be exploited remotely?
No, CVE-2010-2946 can only be exploited by local users with access to the system.
What types of systems are vulnerable to CVE-2010-2946?
CVE-2010-2946 impacts various Linux distributions, including older Ubuntu and Debian versions.