CVE-2010-2954

Published: 3 September 2010

The irda_bind function in net/irda/af_irda.c in the Linux kernel before 2.6.36-rc3-next-20100901 does not properly handle failure of the irda_open_tsap function, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact via multiple unsuccessful calls to bind on an AF_IRDA (aka PF_IRDA) socket.

From the Ubuntu Security Team

Tavis Ormandy discovered that the IRDA subsystem did not correctly shut down. A local attacker could exploit this to cause the system to crash or possibly gain root privileges.

Priority

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Released (2.6.24-28.80)
	jaunty	Released (2.6.28-19.66)
	karmic	Released (2.6.31-22.67)
	lucid	Released (2.6.32-25.45)
	maverick	Not vulnerable
	upstream	Released (2.6.36~rc4)
	Patches: upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=628e300cccaa628d8fb92aa28cb7530a3d5f2257 hardy: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2954/patches/hardy/linux/0001-irda-Correctly-clean-up-self-ias_obj-on-irda_bind-fail.txt jaunty: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2954/patches/jaunty/linux/0001-irda-Correctly-clean-up-self-ias_obj-on-irda_bind-fail.txt karmic: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2954/patches/karmic/linux/0001-irda-Correctly-clean-up-self-ias_obj-on-irda_bind-fail.txt lucid: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2954/patches/lucid/linux/0001-irda-Correctly-clean-up-self-ias_obj-on-irda_bind-fail.txt
linux-ec2 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-307.21)
	lucid	Released (2.6.32-309.18)
	maverick	Ignored (end of life)
	upstream	Released (2.6.36~rc4)
linux-fsl-imx51 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-112.30)
	lucid	Released (2.6.31-608.22)
	maverick	Does not exist
	upstream	Released (2.6.36~rc4)
linux-lts-backport-maverick Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Does not exist
	lucid	Released (2.6.35-25.44~lucid1)
	maverick	Does not exist
	upstream	Released (2.6.36~rc4)
linux-mvl-dove Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Ignored (end of life)
	lucid	Released (2.6.32-216.33)
	maverick	Released (2.6.32-416.33)
	upstream	Released (2.6.36~rc4)
linux-source-2.6.15 Launchpad, Ubuntu, Debian	dapper	Not vulnerable
	hardy	Does not exist
	jaunty	Does not exist
	karmic	Does not exist
	lucid	Does not exist
	maverick	Does not exist
	upstream	Released (2.6.36~rc4)
linux-ti-omap4 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Does not exist
	lucid	Does not exist
	maverick	Released (2.6.35-903.22)
	upstream	Released (2.6.36~rc4)

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›