CVE-2010-4525

Published: 11 January 2011

Linux kernel 2.6.33 and 2.6.34.y does not initialize the kvm_vcpu_events->interrupt.pad structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors.

From the Ubuntu Security Team

Jan Kiszka discovered that KVM did not correctly initialize memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy.

Status

References

• http://www.openwall.com/lists/oss-security/2011/01/05/1
• https://www.cve.org/CVERecord?id=CVE-2010-4525
• NVD
• Launchpad
• Debian