CVE-2010-2955
Published: 8 September 2010
The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.
From the Ubuntu Security Team
Brad Spengler discovered that the wireless extensions did not correctly validate certain request sizes. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy.
Priority
Status
Package | Release | Status |
---|---|---|
linux-raspi2 Launchpad, Ubuntu, Debian |
vivid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
wily |
Not vulnerable
|
|
linux Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Not vulnerable
|
|
jaunty |
Released
(2.6.28-19.66)
|
|
karmic |
Released
(2.6.31-22.67)
|
|
lucid |
Released
(2.6.32-26.47)
|
|
maverick |
Released
(2.6.35-22.34)
|
|
natty |
Not vulnerable
(2.6.37-2.9)
|
|
oneiric |
Not vulnerable
(2.6.39-0.0)
|
|
precise |
Not vulnerable
(3.1.0-1.1)
|
|
quantal |
Not vulnerable
(3.4.0-1.1)
|
|
raring |
Not vulnerable
(3.7.0-0.5)
|
|
saucy |
Not vulnerable
(3.9.0-0.2)
|
|
trusty |
Not vulnerable
(3.11.0-12.19)
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Not vulnerable
(3.13.0-24.46)
|
|
vivid |
Not vulnerable
(3.16.0-23.31)
|
|
wily |
Not vulnerable
(3.16.0-23.31)
|
|
Patches: upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=42da2f948d949efd0111309f5827bf0298bcc9a4 jaunty: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/jaunty/linux/0001-wireless-extensions-fix-kernel-heap-content-leak.txt karmic: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/karmic/linux/0001-wireless-extensions-fix-kernel-heap-content-leak.txt lucid: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/lucid/linux/0001-wireless-extensions-fix-kernel-heap-content-leak.txt |
||
linux-armadaxp Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Not vulnerable
(3.2.0-1600.1)
|
|
quantal |
Not vulnerable
(3.2.0-1602.5)
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-backports-modules-2.6.24 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Ignored
(end of life)
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
lucid |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
Patches: hardy: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/hardy/lbm/0001-wireless-extensions-fix-kernel-heap-content-leak.txt |
||
linux-backports-modules-2.6.28 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
jaunty |
Ignored
(end of life)
|
|
karmic |
Does not exist
|
|
lucid |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
Patches: jaunty: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/jaunty/lbm/0001-wireless-extensions-fix-kernel-heap-content-leak.txt |
||
linux-backports-modules-2.6.32 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
lucid |
Ignored
(end of life)
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Needs triage
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
Patches: lucid: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/lucid/lbm/0001-wireless-extensions-fix-kernel-heap-content-leak.txt |
||
linux-ec2 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Released
(2.6.31-307.21)
|
|
lucid |
Released
(2.6.32-310.21)
|
|
maverick |
Ignored
(end of life)
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-flo Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
(trusty was not-affected [3.4.0-1.3])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Not vulnerable
(3.4.0-3.10)
|
|
vivid |
Not vulnerable
(3.4.0-3.15)
|
|
wily |
Not vulnerable
(3.4.0-3.15)
|
|
linux-fsl-imx51 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
karmic |
Released
(2.6.31-112.30)
|
|
lucid |
Released
(2.6.31-608.22)
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-goldfish Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was not-affected [3.4.0-1.9])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Not vulnerable
(3.4.0-3.14)
|
|
vivid |
Not vulnerable
(3.4.0-4.23)
|
|
wily |
Not vulnerable
(3.4.0-4.23)
|
|
linux-grouper Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was not-affected [3.1.10-8.28])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Not vulnerable
(3.1.10-8.28)
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-backport-maverick Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
lucid |
Released
(2.6.35-22.34~lucid1)
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-backport-natty Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Not vulnerable
(2.6.38-1.27~lucid1)
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-backport-oneiric Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Not vulnerable
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-quantal Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Not vulnerable
(3.5.0-18.29~precise1)
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-raring Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
lucid |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Not vulnerable
(3.8.0-19.30~precise1)
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-saucy Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Not vulnerable
(3.11.0-13.20~precise2)
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Not vulnerable
(3.13.0-24.46~precise1)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-utopic Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was not-affected [3.16.0-25.33~14.04.2])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-vivid Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was not-affected [3.19.0-18.18~14.04.1])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-maguro Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was not-affected [3.0.0-3.18])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-mako Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was not-affected [3.4.0-3.21])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Not vulnerable
(3.4.0-5.28)
|
|
vivid |
Not vulnerable
(3.4.0-5.34)
|
|
wily |
Not vulnerable
(3.4.0-5.34)
|
|
linux-manta Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was not-affected [3.4.0-4.19])
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Not vulnerable
(3.4.0-6.25)
|
|
vivid |
Not vulnerable
(3.4.0-6.29)
|
|
wily |
Not vulnerable
(3.4.0-6.29)
|
|
linux-mvl-dove Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
karmic |
Ignored
(end of life)
|
|
lucid |
Released
(2.6.32-213.29)
|
|
maverick |
Released
(2.6.32-414.30)
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-source-2.6.15 Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
|
hardy |
Does not exist
|
|
jaunty |
Does not exist
|
|
karmic |
Does not exist
|
|
lucid |
Does not exist
|
|
maverick |
Does not exist
|
|
natty |
Does not exist
|
|
oneiric |
Does not exist
|
|
precise |
Does not exist
|
|
quantal |
Does not exist
|
|
raring |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-ti-omap4 Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
hardy |
Does not exist
|
|
karmic |
Does not exist
|
|
lucid |
Does not exist
|
|
maverick |
Released
(2.6.35-903.22)
|
|
natty |
Not vulnerable
(2.6.38-1201.2)
|
|
oneiric |
Not vulnerable
(2.6.38-1309.13)
|
|
precise |
Not vulnerable
(3.0.0-1401.2)
|
|
quantal |
Not vulnerable
(2.6.38-1309.13)
|
|
raring |
Not vulnerable
(2.6.38-1309.13)
|
|
saucy |
Not vulnerable
(3.5.0-223.34)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(2.6.36~rc4)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2955
- https://ubuntu.com/security/notices/USN-1074-1
- https://ubuntu.com/security/notices/USN-1074-2
- https://ubuntu.com/security/notices/USN-1083-1
- https://ubuntu.com/security/notices/USN-1093-1
- https://ubuntu.com/security/notices/USN-1119-1
- https://ubuntu.com/security/notices/USN-1023-1
- NVD
- Launchpad
- Debian