Your submission was sent successfully! Close

CVE-2010-3859

Published: 29 December 2010

Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c.

From the Ubuntu Security Team

Dan Rosenberg discovered that the Linux kernel TIPC implementation contained multiple integer signedness errors. A local attacker could exploit this to gain root privileges.

Notes

AuthorNote
kees
Upstream commits 8acfe468b0384e834a303f08ebc4953d72fb690a and
253eacc070b114c2ec1f81b067d2fed7305467b0
Priority

Medium

Status

Package Release Status
linux
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy
Released (2.6.24-28.86)
jaunty Ignored
(reached end-of-life)
karmic
Released (2.6.31-22.73)
lucid
Released (2.6.32-28.52)
maverick
Released (2.6.35-25.43)
natty
Released (2.6.37-2.9)
upstream
Released (2.6.37~rc1)
Patches:
upstream: http://git.kernel.org/linus/8acfe468b0384e834a303f08ebc4953d72fb690a
upstream: http://git.kernel.org/linus/253eacc070b114c2ec1f81b067d2fed7305467b0
linux-ec2
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Does not exist

jaunty Does not exist

karmic
Released (2.6.31-307.27)
lucid
Released (2.6.32-312.24)
maverick Ignored
(binary supplied by "linux" now)
natty Does not exist

upstream
Released (2.6.37~rc1)
linux-fsl-imx51
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Does not exist

karmic
Released (2.6.31-112.30)
lucid
Released (2.6.31-610.27)
maverick Does not exist

natty Does not exist

upstream
Released (2.6.37~rc1)
linux-lts-backport-maverick
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Does not exist

jaunty Does not exist

karmic Does not exist

lucid
Released (2.6.35-25.44~lucid1)
maverick Does not exist

natty Does not exist

upstream
Released (2.6.37~rc1)
linux-lts-backport-natty
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Not vulnerable
(2.6.38-1.27~lucid1)
maverick Does not exist

natty Does not exist

upstream
Released (2.6.37~rc1)
linux-mvl-dove
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Does not exist

karmic Ignored
(abandonded branch)
lucid
Released (2.6.32-214.30)
maverick
Released (2.6.32-414.30)
natty Does not exist

upstream
Released (2.6.37~rc1)
linux-source-2.6.15
Launchpad, Ubuntu, Debian
dapper
Released (2.6.15-55.93)
hardy Does not exist

jaunty Does not exist

karmic Does not exist

lucid Does not exist

maverick Does not exist

natty Does not exist

upstream
Released (2.6.37~rc1)
linux-ti-omap4
Launchpad, Ubuntu, Debian
dapper Does not exist

hardy Does not exist

karmic Does not exist

lucid Does not exist

maverick
Released (2.6.35-903.23)
natty
Released (2.6.38-1201.2)
upstream
Released (2.6.37~rc1)