CVE-2010-2960: Null Pointer Dereference
Description of problem: Reported by Taviso Ormandy via the Ubuntu Security Team.
$ gcc keyctl.c -o keyctl -lkeyutils $ ./keyctl [ 213.999221] BUG: unable to handle kernel NULL pointer dereference at 00000034 [ 214.002770] IP: [<c02f0f2a>] keyctlsessiontoparent+0x12a/0x1c0 [ 214.006011] pde = 0fdb0067 pte = 00000000 [ 214.008007] Oops: 0000 [#1] SMP [ 214.008973] last sysfs file: /sys/module/ppdev/initstate [ 214.010466] Modules linked in: binfmtmisc vmblock vsock vmmemctl vmhgfs acpiphp sndens1371 gameport sndac97codec ac97bus sndpcmoss sndmixeross sndpcm sndseqdummy sndseqoss sndseqmidi sndrawmidi sndseqmidievent sndseq sndtimer sndseqdevice ppdev fbcon tileblit font bitblit softcursor snd psmouse serioraw parportpc soundcore sndpagealloc vmci shpchp i2cpiix4 vga16fb vgastate intelagp agpgart lp parport mptspi mptscsih mptbase floppy scsitransportspi vmxnet [ 214.024416] [ 214.024899] Pid: 1772, comm: a.out Not tainted (2.6.32-24-generic #41-Ubuntu) VMware Virtual Platform [ 214.027413] EIP: 0060:[<c02f0f2a>] EFLAGS: 00210046 CPU: 0 [ 214.028927] EIP is at keyctlsessiontoparent+0x12a/0x1c0 [ 214.030419] EAX: d2cde100 EBX: d2cdeb00 ECX: 000003e8 EDX: cfcfc480 [ 214.032132] ESI: cfddb300 EDI: 00000000 EBP: d2c33f94 ESP: d2c33f7c [ 214.033811] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 214.035292] Process a.out (pid: 1772, ti=d2c32000 task=d79bbfc0 task.ti=d2c32000) [ 214.037346] Stack: [ 214.037926] 00000000 000003e8 d2cde700 004370c0 00000012 08048520 d2c33fac c02f22e5 [ 214.040262] <0> 00000004 00000012 00327ff4 08048520 d2c32000 c01033ec 00000012 004370c0 [ 214.042795] <0> 0804852b 00327ff4 08048520 00000001 00000120 0000007b 0000007b 00000000 [ 214.045405] Call Trace: [ 214.046108] [<c02f22e5>] ? syskeyctl+0x65/0x170 [ 214.047434] [<c01033ec>] ? syscallcall+0x7/0xb [ 214.048711] Code: 90 0f 85 77 ff ff ff 8b 7a 08 89 7d ec 3b 78 18 0f 85 68 ff ff ff 3b 7a 18 0f 85 5f ff ff ff 3b 7a 10 0f 85 56 ff ff ff 8b 7d e8 <3b> 4f 34 8d 76 00 0f 85 47 ff ff ff 8b 7d f0 3b 4f 34 0f 85 3b [ 214.056401] EIP: [<c02f0f2a>] keyctlsessiontoparent+0x12a/0x1c0 SS:ESP 0068:d2c33f7c [ 214.058676] CR2: 0000000000000034 [ 214.059605] ---[ end trace cc41d96061101854 ]---
Other sources
The keyctlsessiontoparent function in security/keys/keyctl.c in the Linux kernel 2.6.35.4 and earlier expects that a certain parent session keyring exists, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a KEYCTLSESSIONTOPARENT argument to the keyctl function.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2960?
CVE-2010-2960 has a severity rating of high due to the risk of a kernel NULL pointer dereference leading to a system crash.
How do I fix CVE-2010-2960?
To fix CVE-2010-2960, you should update your Linux kernel to a version that addresses this vulnerability.
Which systems are affected by CVE-2010-2960?
CVE-2010-2960 affects various versions of the Linux kernel and Ubuntu Linux including versions up to 2.6.35.4.
What is the potential impact of exploiting CVE-2010-2960?
Exploiting CVE-2010-2960 may lead to a denial of service by causing the kernel to panic and crash.
Is there a workaround for CVE-2010-2960?
Currently, there are no known workarounds for CVE-2010-2960 other than applying the necessary updates.