CVE-2010-3081: Buffer Overflow
Description of problem: A vulnerability in the 32-bit compatibility layer for 64-bit systems was reported. It is caused by insecure allocation of user space memory when translating system call inputs to 64-bit. A stack pointer underflow can occur when using the "compatallocuserspace" method with an arbitrary length input.
Reference: http://sota.gen.nz/compat1/
Upstream commit: http://git.kernel.org/linus/c41d68a513c71e35a14f66d71782d27a79a81ea6
Acknowledgements:
Red Hat would like to thank Ben Hawkes for reporting this issue.
Other sources
The compatallocuserspace functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compatmcgetsockopt function (aka the MCASTMSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3081?
CVE-2010-3081 is classified as a high severity vulnerability due to the potential for stack pointer underflow, which can lead to system instability or unauthorized access.
How do I fix CVE-2010-3081?
To fix CVE-2010-3081, it is recommended to apply the latest security patches and updates provided by your Linux distribution or upgrade to a version of the Linux kernel that is not vulnerable.
Which systems are affected by CVE-2010-3081?
CVE-2010-3081 affects various versions of the Linux kernel, specifically those prior to 2.6.36 and certain versions of VMware ESX and SUSE Linux Enterprise.
What type of vulnerability is CVE-2010-3081?
CVE-2010-3081 is a memory handling vulnerability specifically related to the compatibility layer in 64-bit Linux systems.
Can CVE-2010-3081 be exploited remotely?
CVE-2010-3081 is not directly exploitable remotely as it requires local user access to trigger the vulnerability.