CVE-2010-3298: Infoleak
Description of problem: http://lkml.org/lkml/2010/9/11/167
The TIOCGICOUNT device ioctl allows unprivileged users to read 9 bytes of uninitialized stack memory, because the "reserved" member of the serialicounterstruct struct declared on the stack in hsogetcount() is not altered or zeroed before being copied back to the user. This patch takes care of it.
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
The hsogetcount function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3298?
CVE-2010-3298 is considered a medium severity vulnerability as it allows unprivileged users to read sensitive information from uninitialized stack memory.
How do I fix CVE-2010-3298?
To mitigate CVE-2010-3298, update your Linux kernel to version 2.6.36 or later, which includes a patch for this vulnerability.
What types of systems are affected by CVE-2010-3298?
CVE-2010-3298 affects various Linux distributions including Debian, Ubuntu, openSUSE, and SUSE Linux Enterprise.
Does CVE-2010-3298 allow remote exploitation?
CVE-2010-3298 does not allow remote exploitation as it requires local access to the system for the unprivileged user.
What data can be leaked due to CVE-2010-3298?
CVE-2010-3298 can leak uninitialized stack memory, potentially exposing sensitive data stored in memory.