CVE-2010-4565: Infoleak
Description of problem: In bcmconnect() (in net/can/bcm.c), there is the following code:
sprintf(bo->procname, "%p", sock);
The CAN protocol uses the address of a kernel heap object sock as a proc filename, revealing information that could be useful during exploitation.
Reference: http://seclists.org/oss-sec/2010/q4/103 http://www.spinics.net/lists/netdev/msg145791.html
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
The bcmconnect function in net/can/bcm.c (aka the Broadcast Manager) in the Controller Area Network (CAN) implementation in the Linux kernel 2.6.36 and earlier creates a publicly accessible file with a filename containing a kernel memory address, which allows local users to obtain potentially sensitive information about kernel memory use by listing this filename.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4565?
The severity of CVE-2010-4565 is considered medium due to information disclosure risks.
How do I fix CVE-2010-4565?
You can fix CVE-2010-4565 by upgrading to a version of the Linux kernel that is higher than 2.6.36.
What does CVE-2010-4565 exploit?
CVE-2010-4565 exploits the CAN protocol vulnerability that reveals kernel heap object addresses.
Which versions of the Linux kernel are affected by CVE-2010-4565?
CVE-2010-4565 affects the Linux kernel versions up to and including 2.6.36.
Is user-mode-linux vulnerable to CVE-2010-4565?
Yes, user-mode-linux is also vulnerable to CVE-2010-4565.