CVE-2010-3861: Infoleak
Description of problem: Calling ETHTOOLGRXCLSRLALL with a large rulecnt will allocate kernel heap without clearing it. For the one driver (niu) that implements it, it will leave the unused portion of heap unchanged and copy the full contents back to userspace.
This is different from CVE-2010-2478, but was introduced at the same time (0853ad66, 2.6.27-rc1).
Upstream commit: http://git.kernel.org/linus/ae6df5f96a51818d6376da5307d773baeece4014
Acknowledgements:
Red Hat would like to thank Kees Cook for reporting this issue.
Other sources
The ethtoolgetrxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOLGRXCLSRLALL ethtool command with a large info.rulecnt value, a different vulnerability than CVE-2010-2478.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3861?
CVE-2010-3861 is classified as a medium severity vulnerability.
How do I fix CVE-2010-3861?
To fix CVE-2010-3861, ensure that your Linux kernel is updated to version 2.6.36 or later.
Which operating systems are affected by CVE-2010-3861?
CVE-2010-3861 affects various distributions of the Linux kernel, including Debian, openSUSE, and Ubuntu.
What does CVE-2010-3861 exploit?
CVE-2010-3861 exploits the kernel heap allocation without clearing unused portions when calling the ETHTOOL_GRXCLSRLALL.
Is CVE-2010-3861 easily exploitable?
CVE-2010-3861 may lead to information disclosure, but its exploitability depends on the specific system configuration.