CVE-2010-4343: Medium severity linux kernel vulnerability
drivers/scsi/bfa/bfacore.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fchost statistics file.
Other sources
The port data structure related to fchost statistics collection is not initialized. This causes system crash when reading the fchost statistics. The fix is to initialize port structure during driver attach.
This can be triggered by reading the fc statistics files under /sys/class/fchost/host#/statistics.
A bfa adapter must be present in the system for the problem to occur.
Upstream commit: http://git.kernel.org/linus/7873ca4e4401f0ecd8868bf1543113467e6bae61
Reference: http://www.spinics.net/lists/linux-scsi/msg43772.html
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4343?
CVE-2010-4343 is categorized as a medium severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2010-4343?
To fix CVE-2010-4343, upgrade your Linux kernel to version 2.6.35 or later, or apply the relevant patches provided by your distribution.
Which versions of the Linux kernel are affected by CVE-2010-4343?
CVE-2010-4343 affects all Linux kernel versions prior to 2.6.35.
Can CVE-2010-4343 affect VMware ESX?
Yes, CVE-2010-4343 specifically affects VMware ESX version 4.0 and 4.1.
What impact does CVE-2010-4343 have on systems?
CVE-2010-4343 allows local users to crash the system by reading certain statistics files, leading to a denial of service.