Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2010-2955

Published: 8 September 2010

The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.

From the Ubuntu Security Team

Brad Spengler discovered that the wireless extensions did not correctly validate certain request sizes. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy.

Priority

Low

Status

Package Release Status
linux
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Not vulnerable

jaunty
Released (2.6.28-19.66)
karmic
Released (2.6.31-22.67)
lucid
Released (2.6.32-26.47)
maverick
Released (2.6.35-22.34)
natty Not vulnerable
(2.6.37-2.9)
oneiric Not vulnerable
(2.6.39-0.0)
precise Not vulnerable
(3.1.0-1.1)
quantal Not vulnerable
(3.4.0-1.1)
raring Not vulnerable
(3.7.0-0.5)
saucy Not vulnerable
(3.9.0-0.2)
trusty Not vulnerable
(3.11.0-12.19)
upstream
Released (2.6.36~rc4)
utopic Not vulnerable
(3.13.0-24.46)
vivid Not vulnerable
(3.16.0-23.31)
wily Not vulnerable
(3.16.0-23.31)
Patches:
upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=42da2f948d949efd0111309f5827bf0298bcc9a4
jaunty: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/jaunty/linux/0001-wireless-extensions-fix-kernel-heap-content-leak.txt
karmic: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/karmic/linux/0001-wireless-extensions-fix-kernel-heap-content-leak.txt
lucid: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/lucid/linux/0001-wireless-extensions-fix-kernel-heap-content-leak.txt



linux-armadaxp
Launchpad, Ubuntu, Debian 		hardy Does not exist

lucid Does not exist

natty Does not exist

oneiric Does not exist

precise Not vulnerable
(3.2.0-1600.1)
quantal Not vulnerable
(3.2.0-1602.5)
raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-backports-modules-2.6.24
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Ignored
(EoL)
jaunty Does not exist

karmic Does not exist

lucid Does not exist

maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream Needs triage

utopic Does not exist

vivid Does not exist

wily Does not exist

Patches:




hardy: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/hardy/lbm/0001-wireless-extensions-fix-kernel-heap-content-leak.txt


linux-backports-modules-2.6.28
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Does not exist

jaunty Ignored
(EoL)
karmic Does not exist

lucid Does not exist

maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream Needs triage

utopic Does not exist

vivid Does not exist

wily Does not exist

Patches:





jaunty: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/jaunty/lbm/0001-wireless-extensions-fix-kernel-heap-content-leak.txt

linux-backports-modules-2.6.32
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Does not exist

jaunty Does not exist

karmic Does not exist

lucid Ignored
(EoL)
maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream Needs triage

utopic Does not exist

vivid Does not exist

wily Does not exist

Patches:






lucid: http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2955/patches/lucid/lbm/0001-wireless-extensions-fix-kernel-heap-content-leak.txt
linux-ec2
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Does not exist

jaunty Does not exist

karmic
Released (2.6.31-307.21)
lucid
Released (2.6.32-310.21)
maverick Ignored
(binary supplied by "linux" now)
natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-flo
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

quantal Does not exist

saucy Does not exist

trusty Does not exist
(trusty was not-affected [3.4.0-1.3])
upstream
Released (2.6.36~rc4)
utopic Not vulnerable
(3.4.0-3.10)
vivid Not vulnerable
(3.4.0-3.15)
wily Not vulnerable
(3.4.0-3.15)
linux-fsl-imx51
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Does not exist

karmic
Released (2.6.31-112.30)
lucid
Released (2.6.31-608.22)
maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-goldfish
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

quantal Does not exist

saucy Ignored

trusty Does not exist
(trusty was not-affected [3.4.0-1.9])
upstream
Released (2.6.36~rc4)
utopic Not vulnerable
(3.4.0-3.14)
vivid Not vulnerable
(3.4.0-4.23)
wily Not vulnerable
(3.4.0-4.23)
linux-grouper
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

quantal Does not exist

saucy Ignored

trusty Does not exist
(trusty was not-affected [3.1.10-8.28])
upstream
Released (2.6.36~rc4)
utopic Not vulnerable
(3.1.10-8.28)
vivid Does not exist

wily Does not exist

linux-lts-backport-maverick
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Does not exist

jaunty Does not exist

karmic Does not exist

lucid
Released (2.6.35-22.34~lucid1)
maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-backport-natty
Launchpad, Ubuntu, Debian 		hardy Does not exist

lucid Not vulnerable
(2.6.38-1.27~lucid1)
maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-backport-oneiric
Launchpad, Ubuntu, Debian 		hardy Does not exist

lucid Not vulnerable

maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-quantal
Launchpad, Ubuntu, Debian 		hardy Does not exist

lucid Does not exist

oneiric Does not exist

precise Not vulnerable
(3.5.0-18.29~precise1)
quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-raring
Launchpad, Ubuntu, Debian 		hardy Does not exist

lucid Does not exist

oneiric Does not exist

precise Not vulnerable
(3.8.0-19.30~precise1)
quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-saucy
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Not vulnerable
(3.11.0-13.20~precise2)
quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-trusty
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Not vulnerable
(3.13.0-24.46~precise1)
saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-utopic
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

trusty Does not exist
(trusty was not-affected [3.16.0-25.33~14.04.2])
upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-lts-vivid
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

trusty Does not exist
(trusty was not-affected [3.19.0-18.18~14.04.1])
upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-maguro
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

quantal Does not exist

saucy Ignored

trusty Does not exist
(trusty was not-affected [3.0.0-3.18])
upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-mako
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

quantal Does not exist

saucy Ignored

trusty Does not exist
(trusty was not-affected [3.4.0-3.21])
upstream
Released (2.6.36~rc4)
utopic Not vulnerable
(3.4.0-5.28)
vivid Not vulnerable
(3.4.0-5.34)
wily Not vulnerable
(3.4.0-5.34)
linux-manta
Launchpad, Ubuntu, Debian 		lucid Does not exist

precise Does not exist

quantal Does not exist

saucy Ignored

trusty Does not exist
(trusty was not-affected [3.4.0-4.19])
upstream
Released (2.6.36~rc4)
utopic Not vulnerable
(3.4.0-6.25)
vivid Not vulnerable
(3.4.0-6.29)
wily Not vulnerable
(3.4.0-6.29)
linux-mvl-dove
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Does not exist

karmic Ignored
(abandonded branch)
lucid
Released (2.6.32-213.29)
maverick
Released (2.6.32-414.30)
natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-raspi2
Launchpad, Ubuntu, Debian 		precise Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
vivid Does not exist

wily Not vulnerable

linux-source-2.6.15
Launchpad, Ubuntu, Debian 		dapper Not vulnerable

hardy Does not exist

jaunty Does not exist

karmic Does not exist

lucid Does not exist

maverick Does not exist

natty Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

linux-ti-omap4
Launchpad, Ubuntu, Debian 		dapper Does not exist

hardy Does not exist

karmic Does not exist

lucid Does not exist

maverick
Released (2.6.35-903.22)
natty Not vulnerable
(2.6.38-1201.2)
oneiric Not vulnerable
(2.6.38-1309.13)
precise Not vulnerable
(3.0.0-1401.2)
quantal Not vulnerable
(2.6.38-1309.13)
raring Not vulnerable
(2.6.38-1309.13)
saucy Not vulnerable
(3.5.0-223.34)
trusty Does not exist

upstream
Released (2.6.36~rc4)
utopic Does not exist

vivid Does not exist

wily Does not exist

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Further reading