CVE-2010-3296: Infoleak
Description of problem: http://lkml.org/lkml/2010/9/11/170 The CHELSIOGETQSETNUM device ioctl allows unprivileged users to read 4 bytes of uninitialized stack memory, because the "addr" member of the chreg struct declared on the stack in cxgbextensionioctl() is not altered or zeroed before being copied back to the user.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
The cxgbextensionioctl function in drivers/net/cxgb3/cxgb3main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIOGETQSETNUM ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3296?
CVE-2010-3296 has been classified as a medium severity vulnerability.
How do I fix CVE-2010-3296?
To fix CVE-2010-3296, it is recommended to apply the latest patches to the affected Linux kernel versions.
Which versions of Linux are affected by CVE-2010-3296?
CVE-2010-3296 affects Linux kernel versions up to 2.6.36 and specific distributions such as Debian, Ubuntu, and SUSE.
What type of vulnerability is CVE-2010-3296?
CVE-2010-3296 is a heap memory vulnerability that allows unprivileged users to access uninitialized stack memory.
What are the potential impacts of CVE-2010-3296?
Exploitation of CVE-2010-3296 could lead to information disclosure of sensitive data stored in memory.