CVE-2010-4258: Null Pointer Dereference
Last updated 24 July 2024
Other sources
Nelson discovered an interesting interaction in the Linux kernel between the clearchildtid feature of clone(2), and the setfs() function used internally in the kernel to temporarily disable accessok() checking of userspace pointers.
Under some (not totally uncommon) circumstances, it is possible for a user to leverage this interaction to turn a kernel oops or BUG() into a write of an integer 0 to a user-controlled address in kernel memory.
This is known to be exploited with CVE-2010-3849 - http://www.redhat.com/security/data/cve/CVE-2010-3849.html.
Acknowledgements:
Red Hat would like to thank Nelson Elhage for reporting this issue.
— Red Hat
The doexit function in kernel/exit.c in the Linux kernel before 2.6.3 ...
— Debian
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4258?
CVE-2010-4258 is classified with a high severity level due to its potential for privilege escalation.
How do I fix CVE-2010-4258?
To fix CVE-2010-4258, update your Linux kernel to a version higher than 2.6.36.2.
Which versions of the Linux kernel are affected by CVE-2010-4258?
CVE-2010-4258 affects Linux kernel versions up to and including 2.6.36.2.
What systems are impacted by CVE-2010-4258?
CVE-2010-4258 impacts various systems including Debian's linux-2.6, Fedora 13, and specific versions of openSUSE.
What is the nature of the vulnerability in CVE-2010-4258?
CVE-2010-4258 involves an interaction in the Linux kernel that can lead to privilege escalation due to improper handling of user-space pointers.