CVE-2010-3437: Null Pointer Dereference
Description of problem: The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a pktcdvddevice from the global pktdevs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index.
This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom").
Upstream commit: http://git.kernel.org/linus/252a52aa4fa22a668f019e55b3aac3ff71ec1c29
Other sources
Integer signedness error in the pktfinddevfromminor function in drivers/block/pktcdvd.c in the Linux kernel before 2.6.36-rc6 allows local users to obtain sensitive information from kernel memory or cause a denial of service (invalid pointer dereference and system crash) via a crafted index value in a PKTCTRLCMDSTATUS ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3437?
CVE-2010-3437 is classified as a high severity vulnerability due to its potential to allow local users to gain elevated privileges.
How do I fix CVE-2010-3437?
To fix CVE-2010-3437, it is recommended to upgrade the affected Linux kernel packages to a version that has addressed this vulnerability.
Which Linux kernel versions are affected by CVE-2010-3437?
CVE-2010-3437 affects the Linux kernel versions up to and including 2.6.36.
Can CVE-2010-3437 be exploited remotely?
No, CVE-2010-3437 requires local access to the system to exploit.
What software distributions are impacted by CVE-2010-3437?
CVE-2010-3437 impacts various distributions including Debian, Ubuntu, and openSUSE with specific noted kernel versions.