CVE-2010-2538

Published: 30 September 2010

Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFS_IOC_CLONE_RANGE ioctl call.

From the Ubuntu Security Team

Dan Rosenberg discovered that the btrfs filesystem did not correctly validate permissions when using the clone function. A local attacker could overwrite the contents of file handles that were opened for append-only, or potentially read arbitrary contents, leading to a loss of privacy.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Not vulnerable
	jaunty	Ignored (end of life)
	karmic	Released (2.6.31-22.70)
	lucid	Released (2.6.32-25.43)
	maverick	Released (2.6.35-14.19)
	upstream	Released (2.6.35~rc6)
	Patches: upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2ebc3464781ad24474abcbd2274e6254689853b5
linux-ec2 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-307.23)
	lucid	Released (2.6.32-311.23)
	maverick	Ignored (end of life)
	upstream	Released (2.6.35~rc6)
linux-fsl-imx51 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-112.30)
	lucid	Released (2.6.31-608.22)
	maverick	Does not exist
	upstream	Released (2.6.35~rc6)
linux-lts-backport-maverick Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Does not exist
	lucid	Released (2.6.35-25.44~lucid1)
	maverick	Does not exist
	upstream	Released (2.6.35~rc6)
linux-source-2.6.15 Launchpad, Ubuntu, Debian	dapper	Not vulnerable
	hardy	Does not exist
	jaunty	Does not exist
	karmic	Does not exist
	lucid	Does not exist
	maverick	Does not exist
	upstream	Released (2.6.35~rc6)

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=616998

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›