CVE-2010-3874: Buffer Overflow
Description of problem: In bcmconnect() (in net/can/bcm.c), there is the following code:
sprintf(bo->procname, "%p", sock);
"procname" is a 9-byte char array. On 64-bit platforms, up to 17 bytes may be copied into the buffer. Fortunately, structure padding will most likely prevent this from being a problem, except for the trailing NULL byte, which may overwrite the first byte of the next heap object.
Reference: http://www.spinics.net/lists/netdev/msg145791.html
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
Heap-based buffer overflow in the bcmconnect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel before 2.6.36.2 on 64-bit platforms might allow local users to cause a denial of service (memory corruption) via a connect operation.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3874?
CVE-2010-3874 is classified as a medium severity vulnerability due to the potential buffer overflow risk on 64-bit systems.
How do I fix CVE-2010-3874?
To fix CVE-2010-3874, ensure that you update to a patched version of the Linux kernel that is above version 2.6.36.2.
Which systems are affected by CVE-2010-3874?
CVE-2010-3874 affects various Linux distributions including Debian, Fedora, and openSUSE versions detailed in the vulnerability description.
What type of vulnerability is CVE-2010-3874?
CVE-2010-3874 is a buffer overflow vulnerability found in the bcm_connect function of the Linux kernel CAN (Controller Area Network) subsystem.
Are there any known exploits for CVE-2010-3874?
As of now, there are no publicly known exploits specifically targeting CVE-2010-3874, but it is advisable to patch vulnerable systems.