CVE-2010-4160: Integer Overflow
Description of problem: Both PPPoL2TP (in net/l2tp/l2tpppp.c, pppol2tpsendmsg()) and IPoL2TP (in net/l2tp/l2tpip.c, l2tpipsendmsg()) make calls to sockwmalloc() that perform arithmetic on the size argument without any maximum bound. As a result, by issuing sendto() calls with very large sizes, this allocation size will wrap and result in a small buffer being allocated, leading to ugliness immediately after (probably kernel panics due to bad skbuff tail position, but possibly kernel heap corruption).
Reference: http://www.spinics.net/lists/netdev/msg145673.html
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
Multiple integer overflows in the (1) pppol2tpsendmsg function in net ...
— Debian
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4160?
CVE-2010-4160 has a high severity level due to the potential for integer overflow vulnerabilities in the Linux kernel.
How do I fix CVE-2010-4160?
To fix CVE-2010-4160, update the Linux kernel to a version that addresses this vulnerability.
What systems are affected by CVE-2010-4160?
CVE-2010-4160 affects various versions of the Linux kernel and specific distributions such as Debian and openSUSE.
What type of vulnerability is CVE-2010-4160?
CVE-2010-4160 is classified as an integer overflow vulnerability affecting the PPPoL2TP and IPoL2TP protocols.
Can CVE-2010-4160 be exploited remotely?
Yes, CVE-2010-4160 can potentially be exploited remotely through crafted sendto() calls.