CVE-2010-2955: Infoleak
Description of problem: This problem was originally tracked down by Brad Spengler.
When calling wireless ioctls, if a driver does not correctly validate/shrink iwp->length, the resulting copytouser can leak up to 64K of kernel heap contents.
It seems that this is triggerable[1] in 2.6.32 at least on ath5k, but I was not able to track down how. The twisty maze of ioctl handlers stumped me. :) Other drivers I checked did not appear to have any problems, but the potential remains. I'm not sure if this patch is the right approach; it was fixed differently[2] in grsecurity.
[1] http://forums.grsecurity.net/viewtopic.php?f=3&t=2290&start=0 [2] http://grsecurity.net/~spender/wireless-infoleak-fix2.patch
Discussion: http://lkml.org/lkml/2010/8/27/413
Other sources
The cfg80211wextgiwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctlstandardiwpoint function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2955?
CVE-2010-2955 has a moderate severity level due to potential information disclosure vulnerabilities.
How do I fix CVE-2010-2955?
To fix CVE-2010-2955, apply the latest patches for the affected versions of the Linux kernel.
Which versions are affected by CVE-2010-2955?
CVE-2010-2955 affects Linux kernel versions prior to 2.6.36 and various versions of Ubuntu and SUSE.
Can CVE-2010-2955 be exploited remotely?
Yes, CVE-2010-2955 can potentially be exploited remotely if a malicious actor can access the vulnerable driver.
What are the consequences of CVE-2010-2955?
Successful exploitation of CVE-2010-2955 may lead to the disclosure of sensitive information from the kernel memory.