CVE-2010-4076: Infoleak
Description of problem: The TIOCGICOUNT device ioctl in amiserial.c allows unprivileged users to read uninitialized stack memory, because the "reserved" member of the serialicounterstruct struct declared on the stack is not altered or zeroed before being copied back to the user.
Reference: http://www.openwall.com/lists/oss-security/2010/10/06/6 http://lkml.org/lkml/2010/9/15/389
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
The rsioctl function in drivers/char/amiserial.c in the Linux kernel 2.6.36.1 and earlier does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4076?
CVE-2010-4076 is considered a moderate severity vulnerability due to its ability to allow unprivileged users to read uninitialized stack memory.
How do I fix CVE-2010-4076?
To fix CVE-2010-4076, update to a patched version of the Linux kernel that addresses this vulnerability.
Who is affected by CVE-2010-4076?
CVE-2010-4076 affects users of the Linux kernel up to version 2.6.36.1, particularly those using the TIOCGICOUNT device ioctl.
What is the impact of exploiting CVE-2010-4076?
Exploiting CVE-2010-4076 may allow attackers to access sensitive information from uninitialized memory on affected systems.
When was CVE-2010-4076 disclosed?
CVE-2010-4076 was disclosed in October 2010.