CVE-2010-4346: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The installspecialmapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected securityfilemmap function call, which allows local users to bypass intended mmapminaddr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.
— Launchpad
The installspecialmapping routine (used, for example, to setup the vdso) skips the security check before insertvmstruct, allowing a local attacker to bypass the mmapminaddr security restriction by limiting the available pages for special mappings.
Reference: https://lkml.org/lkml/2010/12/9/222 http://seclists.org/oss-sec/2010/q4/307
Acknowledgements: Red Hat would like to thank Tavis Ormandy for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4346?
CVE-2010-4346 is considered to have a medium severity due to the potential for local users to bypass mmap_min_addr restrictions.
How do I fix CVE-2010-4346?
To fix CVE-2010-4346, upgrade to Linux kernel version 2.6.37 or later.
Who is affected by CVE-2010-4346?
Local users running vulnerable versions of the Linux kernel prior to 2.6.37 are affected by CVE-2010-4346.
What kind of attack can CVE-2010-4346 enable?
CVE-2010-4346 allows for potential NULL pointer dereference attacks due to the failure to call the security_file_mmap function.
In which versions of Linux is CVE-2010-4346 present?
CVE-2010-4346 is present in Linux kernel versions prior to 2.6.37-rc6.