CVE-2010-3067: Integer Overflow
Description of problem: This doesn't look correct, the iosubmit systemcall calls doiosubmit() directly:
SYSCALLDEFINE3(iosubmit, aiocontextt, ctxid, long, nr, struct iocb user user , iocbpp) { return doiosubmit(ctxid, nr, iocbpp, 0); }
doiosubmit only checks if nr < 0, but doesnt check if the accessok multiplication will overflow.
long doiosubmit(aiocontextt ctxid, long nr, struct iocb user user iocbpp, bool compat) { ... if (unlikely(!accessok(VERIFYREAD, iocbpp, (nrsizeof(iocbpp))))) return -EFAULT; ...
Then it uses this loop with getusernocheck(), which doesn't look safe.
... for (i=0; i<nr; i++) { struct iocb user useriocb; struct iocb tmp;
if (unlikely(getuser(useriocb, iocbpp + i))) { ret = -EFAULT; break; } ...
Acknowledgements:
Red Hat would like to thank Tavis Ormandy for reporting this issue.
Other sources
Integer overflow in the doiosubmit function in fs/aio.c in the Linux kernel before 2.6.36-rc4-next-20100915 allows local users to cause a denial of service or possibly have unspecified other impact via crafted use of the iosubmit system call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3067?
CVE-2010-3067 has been classified with a moderate severity level due to its potential impact on system stability.
How do I fix CVE-2010-3067?
To mitigate CVE-2010-3067, upgrade your Linux kernel to version 2.6.36 or later.
What software is affected by CVE-2010-3067?
CVE-2010-3067 affects multiple versions of the Linux kernel including 2.6.36 and earlier versions.
Is CVE-2010-3067 exploitable remotely?
Exploitation of CVE-2010-3067 is typically local, requiring user privileges to trigger the vulnerability.
What are the consequences of CVE-2010-3067?
Exploiting CVE-2010-3067 may lead to system crashes or unstable behavior due to improper handling of I/O operations.