CVE-2010-3876: Low severity linux kernel vulnerability
Description of problem: packetgetnamespkt() doesn't initialize all members of sadata field of sockaddr struct if strlen(dev->name) < 13. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. We have to fully fill sadata with strncpy() instead of strlcpy().
The same with packetgetname(): it doesn't initialize sllpkttype field of sockaddrll. Set it to zero.
Reference: http://marc.info/?l=linux-netdev&m=128854507220908&w=2 http://seclists.org/oss-sec/2010/q4/94
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Other sources
net/packet/afpacket.c in the Linux kernel before 2.6.37-rc2 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAPNETRAW capability to read copies of the applicable structures.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3876?
CVE-2010-3876 has a medium severity rating due to its potential for leaking kernel stack memory contents.
How do I fix CVE-2010-3876?
To fix CVE-2010-3876, ensure you update to a kernel version beyond 2.6.37 where the vulnerability has been patched.
Which systems are affected by CVE-2010-3876?
CVE-2010-3876 affects various versions of the Linux kernel and specific distributions such as Debian and openSUSE.
What can happen if CVE-2010-3876 is exploited?
Exploitation of CVE-2010-3876 could allow unauthorized access to sensitive information from kernel memory.
Is CVE-2010-3876 a remote code execution vulnerability?
No, CVE-2010-3876 is not a remote code execution vulnerability but rather a local information disclosure vulnerability.