CVE-2010-4162: Integer Overflow
Due to integer underflow and overflow issues when determining the number of pages required for maliciously crafted I/O requests, a local user could send a device ioctl that results in the sequential allocation of a very large number of pages, causing the OOM killer to be invoked and crashing the system:
Proposed patch: http://git.kernel.org/?p=linux/kernel/git/axboe/linux-2.6-block.git;a=commit;h=cb4644cac4a2797afc847e6c92736664d4b0ea34
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
Multiple integer overflows in fs/bio.c in the Linux kernel before 2.6.36.2 allow local users to cause a denial of service (system crash) via a crafted device ioctl to a SCSI device.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4162?
CVE-2010-4162 has a medium severity rating due to the potential for local users to cause system crashes.
How do I fix CVE-2010-4162?
To mitigate CVE-2010-4162, update the affected Linux Kernel to a version higher than 2.6.36.2.
Who is affected by CVE-2010-4162?
CVE-2010-4162 affects users of specific Linux kernel versions, including various distributions like Fedora and openSUSE.
What is the impact of CVE-2010-4162?
The impact of CVE-2010-4162 includes potential system crashes due to the OOM killer being invoked by maliciously crafted I/O requests.
Is CVE-2010-4162 a remote or local vulnerability?
CVE-2010-4162 is a local vulnerability that requires an authenticated local user to exploit.