CVE-2010-4157: Integer Overflow
Description of problem: gdthioctlalloc() takes the size variable as an int. copyfromuser() takes the size variable as an unsigned long. gen.datalen and gen.senselen are unsigned longs. On x8664 longs are 64 bit and ints are 32 bit.
We could pass in a very large number and the allocation would truncate the size to 32 bits and allocate a small buffer. Then when we do the copyfromuser(), it would result in a memory corruption.
Reference: http://ns3.spinics.net/lists/linux-scsi/msg47361.html
Upstream: http://git.kernel.org/linus/f63ae56e4e97fb12053590e41a4fa59e7daa74a4
Other sources
Integer overflow in the iocgeneral function in drivers/scsi/gdth.c in the Linux kernel before 2.6.36.1 on 64-bit platforms allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large argument in an ioctl call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4157?
CVE-2010-4157 is considered a medium severity vulnerability that can lead to denial of service or potential arbitrary code execution.
How do I fix CVE-2010-4157?
To fix CVE-2010-4157, you should update your kernel to a version that includes the patch addressing this vulnerability.
Which systems are affected by CVE-2010-4157?
CVE-2010-4157 affects multiple Linux kernel versions, particularly those prior to 2.6.36.1, and various distributions, including Debian, Fedora, and openSUSE.
What type of vulnerability is CVE-2010-4157?
CVE-2010-4157 is a type of integer overflow vulnerability caused by improper handling of size parameters during memory allocation.
Is CVE-2010-4157 actively exploited?
There have been no public reports of active exploitation of CVE-2010-4157, but it is recommended to mitigate it due to its potential impact.