CVE-2010-4072: Infoleak
Description of problem: The old shm interface allows unprivileged users to read uninitialized stack memory, because shmidds structure declared on the stack is not altered or zeroed before being copied back to the user.
Reference: http://www.openwall.com/lists/oss-security/2010/10/07/1 http://lkml.org/lkml/2010/10/6/454
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall and Kees Cook for reporting this issue.
Other sources
The copyshmidtouser function in ipc/shm.c in the Linux kernel before 2.6.37-rc1 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to the shmctl system call and the "old shm interface."
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4072?
CVE-2010-4072 is considered a medium severity vulnerability.
How do I fix CVE-2010-4072?
To fix CVE-2010-4072, ensure your system is updated with the latest patches for the affected Linux kernel versions.
What does CVE-2010-4072 affect?
CVE-2010-4072 affects the Linux kernel versions up to 2.6.37 and various distributions including Debian and openSUSE.
What type of vulnerability is CVE-2010-4072?
CVE-2010-4072 is a vulnerability that allows unprivileged users to read uninitialized stack memory.
Which systems are vulnerable to CVE-2010-4072?
Systems using unpatched versions of the Linux kernel, particularly below 2.6.37, are vulnerable to CVE-2010-4072.