CVE-2010-3861

Published: 10 December 2010

The ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize a certain block of heap memory, which allows local users to obtain potentially sensitive information via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value, a different vulnerability than CVE-2010-2478.

From the Ubuntu Security Team

Kees Cook discovered that the ethtool interface did not correctly clear kernel memory. A local attacker could read kernel heap memory, leading to a loss of privacy.

Priority

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Not vulnerable
	jaunty	Ignored (reached end-of-life)
	karmic	Released (2.6.31-22.70)
	lucid	Released (2.6.32-27.49)
	maverick	Released (2.6.35-24.42)
	upstream	Released (2.6.36~rc8)
	Patches: upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ae6df5f96a51818d6376da5307d773baeece4014 karmic: http://chinstrap.ubuntu.com/~ogasawara/CVEs/CVE-2010-3861/patches/karmic/linux/0001-net-clear-heap-allocation-for-ETHTOOL_GRXCLSRLALL.txt lucid: http://chinstrap.ubuntu.com/~ogasawara/CVEs/CVE-2010-3861/patches/lucid/linux/0001-net-clear-heap-allocation-for-ETHTOOL_GRXCLSRLALL.txt maverick: http://chinstrap.ubuntu.com/~ogasawara/CVEs/CVE-2010-3861/patches/maverick/linux/0001-net-clear-heap-allocation-for-ETHTOOL_GRXCLSRLALL.txt
linux-ec2 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-307.23)
	lucid	Released (2.6.32-311.23)
	maverick	Ignored (binary supplied by "linux" now)
	upstream	Released (2.6.36~rc8)
linux-fsl-imx51 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Released (2.6.31-112.30)
	lucid	Released (2.6.31-608.22)
	maverick	Does not exist
	upstream	Released (2.6.36~rc8)
linux-lts-backport-maverick Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Does not exist
	lucid	Released (2.6.35-25.44~lucid1)
	maverick	Does not exist
	upstream	Released (2.6.36~rc8)
linux-mvl-dove Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Ignored (abandonded branch)
	lucid	Released (2.6.32-216.33)
	maverick	Released (2.6.32-416.33)
	upstream	Released (2.6.36~rc8)
linux-source-2.6.15 Launchpad, Ubuntu, Debian	dapper	Not vulnerable
	hardy	Does not exist
	jaunty	Does not exist
	karmic	Does not exist
	lucid	Does not exist
	maverick	Does not exist
	upstream	Released (2.6.36~rc8)
linux-ti-omap4 Launchpad, Ubuntu, Debian	dapper	Does not exist
	hardy	Does not exist
	karmic	Does not exist
	lucid	Does not exist
	maverick	Released (2.6.35-903.22)
	upstream	Released (2.6.36~rc8)

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›