CVE-2010-4650: Buffer Overflow
Buffer overflow in the fusedoioctl function in fs/fuse/file.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging the ability to operate a CUSE server.
Other sources
Verify that the total length of the iovec returned in FUSEIOCTLRETRY doesn't overflow iovlength().
Upstream commit: http://git.kernel.org/linus/7572777eef78ebdee1ecb7c258c0ef94d35bad16
Introduced in 59efec7b v2.6.29-rc1
long fusedoioctl(struct file file, unsigned int cmd, unsigned long arg, unsigned int flags) { [...] / did it ask for retry? / if (outarg.flags & FUSEIOCTLRETRY) { [...] / no retry if in restricted mode / err = -EIO; if (!(flags & FUSEIOCTLUNRESTRICTED)) goto out; [...] iniov = pageaddress(iovpage); outiov = iniov + iniovs;
So this affects unrestricted ioctl that is used by CUSE. Others use restricted ioctl.
On Red Hat Enterprise Linux 6, /dev/cuse is root-owned by default. crw-rw----. 1 root root 10, 57 Jan 7 06:51 /dev/cuse
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-4650?
CVE-2010-4650 is considered to have a high severity as it can lead to a denial of service vulnerability.
How do I fix CVE-2010-4650?
To fix CVE-2010-4650, upgrade the Linux kernel to version 2.6.37 or later.
Which versions of the Linux kernel are affected by CVE-2010-4650?
CVE-2010-4650 affects Linux kernel versions up to 2.6.36.4.
Who can exploit CVE-2010-4650?
Local users with the ability to operate a CUSE server can exploit CVE-2010-4650.
What impact can CVE-2010-4650 have on a system?
CVE-2010-4650 can potentially cause a denial of service or other unspecified impacts on the system.