CVE-2010-3881: Infoleak
arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device.
Other sources
Description of problem: Structures kvmvcpuevents, kvmdebugregs, kvmpitstate2 and kvmclockdata are copied to userland with some padding and reserved fields unitialized. It leads to leaking of contents of kernel stack memory.
Reference: http://www.spinics.net/lists/kvm/msg44130.html http://git.kernel.org/?p=virt/kvm/kvm.git;a=commit;h=831d9d02f9522e739825a51a11e3bc5aa531a905
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3881?
CVE-2010-3881 has a medium severity rating due to its potential to expose sensitive information from the kernel stack to local users.
How do I fix CVE-2010-3881?
To address CVE-2010-3881, upgrade the Linux kernel to version 2.6.36.2 or later.
Which systems are affected by CVE-2010-3881?
CVE-2010-3881 affects Linux kernel versions prior to 2.6.36.2 across several distributions like Debian, Red Hat, and SUSE.
What behavior does CVE-2010-3881 exploit?
CVE-2010-3881 exploits the failure to initialize certain structure members in the Linux kernel, allowing unauthorized access to kernel memory.
Who can be affected by CVE-2010-3881?
Local users on systems running affected versions of the Linux kernel can be impacted by CVE-2010-3881 as it allows them to read sensitive information.