CVE-2010-3873

Published: 3 January 2011

The X.25 implementation in the Linux kernel before 2.6.36.2 does not properly parse facilities, which allows remote attackers to cause a denial of service (heap memory corruption and panic) or possibly have unspecified other impact via malformed (1) X25_FAC_CALLING_AE or (2) X25_FAC_CALLED_AE data, related to net/x25/x25_facilities.c and net/x25/x25_in.c, a different vulnerability than CVE-2010-4164.

From the Ubuntu Security Team

Dan Rosenberg discovered that the Linux kernel X.25 implementation incorrectly parsed facilities. A remote attacker could exploit this to crash the kernel, leading to a denial of service.

Notes

net: ax25: fix information leak to userland harder, CVE-2010-3875 We
took the additional step of fixing the original patch since it allowed an
SKB leak.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3873
• https://ubuntu.com/security/notices/USN-1071-1
• https://ubuntu.com/security/notices/USN-1072-1
• https://ubuntu.com/security/notices/USN-1073-1
• https://ubuntu.com/security/notices/USN-1093-1
• https://ubuntu.com/security/notices/USN-1119-1
• https://ubuntu.com/security/notices/USN-1164-1
• https://ubuntu.com/security/notices/USN-1054-1
• https://ubuntu.com/security/notices/USN-1244-1
• NVD
• Launchpad
• Debian