CVE-2010-4082: Low severity Linux Linux kernel vulnerability
Description of problem: The VIAFBGETINFO device ioctl allows unprivileged users to read 1968 bytes of uninitialized stack memory, because the "reserved" member of the viafbioctlinfo struct declared on the stack is not altered or zeroed before being copied back to the user.
Reference: http://www.openwall.com/lists/oss-security/2010/10/06/6 http://lkml.indiana.edu/hypermail//linux/kernel/1009.1/03392.html
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
The viafbioctlgetviafbinfo function in drivers/video/via/ioctl.c i ...
— Debian
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4082?
CVE-2010-4082 is considered a medium severity vulnerability due to its potential to expose sensitive information through uninitialized stack memory.
How do I fix CVE-2010-4082?
To fix CVE-2010-4082, ensure you update the Linux kernel to a version higher than 2.6.36 which addresses the vulnerability.
Who is affected by CVE-2010-4082?
CVE-2010-4082 affects users of the Linux kernel versions up to and including 2.6.36.
What kind of vulnerability is CVE-2010-4082?
CVE-2010-4082 is a privilege escalation vulnerability that allows unprivileged users to read sensitive memory.
Is CVE-2010-4082 related to specific Linux distributions?
Yes, CVE-2010-4082 impacts various distributions, including Debian and openSUSE, that use the vulnerable kernel versions.