NVD Vulnerability Detail

CVE-2010-3081

Summary	The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Publication Date	Sept. 25, 2010, 5 a.m.
Registration Date	Jan. 29, 2021, 11:04 a.m.
Last Update	Nov. 21, 2024, 10:17 a.m.

CVSS3.1 : HIGH
スコア	7.8
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel:2.6.36:rc2::::::
cpe:2.3:o:linux:linux_kernel:2.6.36:rc1::::::
cpe:2.3:o:linux:linux_kernel:2.6.36:rc3::::::
cpe:2.3:o:linux:linux_kernel::::::::		2.6.35.4
cpe:2.3:o:linux:linux_kernel:2.6.36:-::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:vmware:esx:4.1:::::::*
cpe:2.3:o:vmware:esx:4.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp1::::::
cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp1::::::

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html	Broken Link
2	http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html	Broken Link
3	http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html	Broken Link
4	http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html	Broken Link
5	http://blog.ksplice.com/2010/09/cve-2010-3081/	Broken Link
6	http://blog.ksplice.com/2010/09/cve-2010-3081/	Broken Link
7	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c41d68a513c71e35a14f66d71782d27a79a81ea6
8	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c41d68a513c71e35a14f66d71782d27a79a81ea6
9	http://isc.sans.edu/diary.html?storyid=9574	Patch Third Party Advisory
10	http://isc.sans.edu/diary.html?storyid=9574	Patch Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html	Mailing List Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html	Mailing List Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html	Mailing List Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html	Mailing List Third Party Advisory
16	http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html	Mailing List Third Party Advisory
17	http://marc.info/?l=oss-security&m=128461522230211&w=2	Mailing List Patch Third Party Advisory
18	http://marc.info/?l=oss-security&m=128461522230211&w=2	Mailing List Patch Third Party Advisory
19	http://secunia.com/advisories/42384	Broken Link
20	http://secunia.com/advisories/42384	Broken Link
21	http://secunia.com/advisories/43315	Broken Link
22	http://secunia.com/advisories/43315	Broken Link
23	http://sota.gen.nz/compat1/	Broken Link
24	http://sota.gen.nz/compat1/	Broken Link
25	http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.log	Broken Link
26	http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.log	Broken Link
27	http://www.mandriva.com/security/advisories?name=MDVSA-2010:198	Broken Link
28	http://www.mandriva.com/security/advisories?name=MDVSA-2010:198	Broken Link
29	http://www.mandriva.com/security/advisories?name=MDVSA-2010:214	Broken Link
30	http://www.mandriva.com/security/advisories?name=MDVSA-2010:214	Broken Link
31	http://www.mandriva.com/security/advisories?name=MDVSA-2010:247	Broken Link
32	http://www.mandriva.com/security/advisories?name=MDVSA-2010:247	Broken Link
33	http://www.redhat.com/support/errata/RHSA-2010-0758.html	Broken Link
34	http://www.redhat.com/support/errata/RHSA-2010-0758.html	Broken Link
35	http://www.redhat.com/support/errata/RHSA-2010-0842.html	Broken Link
36	http://www.redhat.com/support/errata/RHSA-2010-0842.html	Broken Link
37	http://www.redhat.com/support/errata/RHSA-2010-0882.html	Broken Link
38	http://www.redhat.com/support/errata/RHSA-2010-0882.html	Broken Link
39	http://www.securityfocus.com/archive/1/514938/30/30/threaded	Third Party Advisory VDB Entry
40	http://www.securityfocus.com/archive/1/514938/30/30/threaded	Third Party Advisory VDB Entry
41	http://www.securityfocus.com/archive/1/516397/100/0/threaded	Third Party Advisory VDB Entry
42	http://www.securityfocus.com/archive/1/516397/100/0/threaded	Third Party Advisory VDB Entry
43	http://www.vmware.com/security/advisories/VMSA-2010-0017.html	Third Party Advisory
44	http://www.vmware.com/security/advisories/VMSA-2010-0017.html	Third Party Advisory
45	http://www.vmware.com/security/advisories/VMSA-2011-0003.html	Third Party Advisory
46	http://www.vmware.com/security/advisories/VMSA-2011-0003.html	Third Party Advisory
47	http://www.vupen.com/english/advisories/2010/3083	Broken Link
48	http://www.vupen.com/english/advisories/2010/3083	Broken Link
49	http://www.vupen.com/english/advisories/2010/3117	Broken Link
50	http://www.vupen.com/english/advisories/2010/3117	Broken Link
51	http://www.vupen.com/english/advisories/2011/0298	Broken Link
52	http://www.vupen.com/english/advisories/2011/0298	Broken Link
53	https://access.redhat.com/kb/docs/DOC-40265	Exploit Patch Third Party Advisory
54	https://access.redhat.com/kb/docs/DOC-40265	Exploit Patch Third Party Advisory
55	https://bugzilla.redhat.com/show_bug.cgi?id=634457	Issue Tracking Patch Third Party Advisory
56	https://bugzilla.redhat.com/show_bug.cgi?id=634457	Issue Tracking Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

64-bit プラットフォーム上で稼働している Linux kernel の compat_alloc_user_space 関数における権限昇格の脆弱性

Title	64-bit プラットフォーム上で稼働している Linux kernel の compat_alloc_user_space 関数における権限昇格の脆弱性
Summary	64-bit プラットフォーム上で稼働している Linux kernel の include/asm/compat.h　ファイル内にある compat_alloc_user_space 関数には、32-bit 互換レイヤーに必要とされる、ユーザ空間のメモリ割り当て処理を適切に行わないため、権限を取得される脆弱性が存在します。
Possible impacts	ローカルユーザにより、compat_mc_getsockopt 関数を介して、権限を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Sept. 21, 2010, midnight
Registration Date	Oct. 8, 2010, 5:08 p.m.
Last Update	March 1, 2011, 2:46 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux 4 (as)

Red Hat Enterprise Linux 4 (es)

Red Hat Enterprise Linux 4 (ws)

Red Hat Enterprise Linux 4.7 (as)

Red Hat Enterprise Linux 4.7 (es)

Red Hat Enterprise Linux 4.8 (as)

Red Hat Enterprise Linux 4.8 (es)

Red Hat Enterprise Linux 5 (server)

Red Hat Enterprise Linux Desktop 4.0

Red Hat Enterprise Linux Desktop 5.0 (client)

Red Hat Enterprise Linux Desktop 6

Red Hat Enterprise Linux ELS 3

Red Hat Enterprise Linux EUS 5.3.z (server)

Red Hat Enterprise Linux EUS 5.4.z (server)

Red Hat Enterprise Linux HPC Node 6

Red Hat Enterprise Linux Server 6

Red Hat Enterprise Linux Workstation 6

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 3.0

Asianux Server 3.0 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

VMware

VMware ESX 3.0.3

VMware ESX 3.5

VMware ESX 3.x

VMware ESX 4.0

VMware ESX 4.1

Linux

Linux Kernel 2.6.36-rc4-git2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-3081	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3081
National Vulnerability Database (NVD)
2	CVE-2010-3081	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-3081

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Asianux Technical Support Network
1	kernel-2.6.18-194.6.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1264
Linux Kernel
2	ChangeLog-2.6.27.54	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.54
3	ChangeLog-2.6.32.22	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.22
4	ChangeLog-2.6.35.5	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.5
MIRACLE LINUX アップデート情報
5	2133	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2133
6	2149	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2149
7	2186	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2186
Red Hat Security Advisory
8	RHSA-2010:0704	https://rhn.redhat.com/errata/RHSA-2010-0704.html
9	RHSA-2010:0705	https://rhn.redhat.com/errata/RHSA-2010-0705.html
10	RHSA-2010:0711	https://rhn.redhat.com/errata/RHSA-2010-0711.html
11	RHSA-2010:0718	https://rhn.redhat.com/errata/RHSA-2010-0718.html
12	RHSA-2010:0719	https://rhn.redhat.com/errata/RHSA-2010-0719.html
13	RHSA-2010:0842	https://rhn.redhat.com/errata/RHSA-2010-0842.html
14	RHSA-2010:0882	https://rhn.redhat.com/errata/RHSA-2010-0882.html
VMware Security Advisories
15	VMSA-2010-0017	http://www.vmware.com/security/advisories/VMSA-2010-0017.html
16	VMSA-2011-0003	http://www.vmware.com/security/advisories/VMSA-2011-0003.html

その他

No	Name	URL
Secunia Advisory
1	SA41462	http://secunia.com/advisories/41462
SecurityFocus
2	43239	http://www.securityfocus.com/bid/43239
VUPEN Security
3	VUPEN/ADV-2010-2423	http://www.vupen.com/english/advisories/2010/2423

Change Log

No	Changed Details	Date of change
0	[2010年10月08日] 掲載 [2010年11月04日] 影響を受けるシステム：ミラクル・リナックス (2133) の情報を追加ベンダ情報：ミラクル・リナックス (2133) の情報を追加 [2010年12月03日] 影響を受けるシステム：レッドハット (RHSA-2010:0842) の情報を追加影響を受けるシステム：レッドハット (RHSA-2010:0882) の情報を追加ベンダ情報：ミラクル・リナックス (2149) を追加ベンダ情報：レッドハット (RHSA-2010:0842) を追加ベンダ情報：レッドハット (RHSA-2010:0882) を追加 [2010年12月17日] 影響を受けるシステム：VMware (VMSA-2010-0017) の情報を追加ベンダ情報：VMware (VMSA-2010-0017) を追加 [2011年03月01日] 影響を受けるシステム：VMware (VMSA-2011-0003) の情報を追加影響を受けるシステム：ミラクル・リナックス (2186) の情報を追加ベンダ情報：VMware (VMSA-2011-0003) を追加ベンダ情報：ミラクル・リナックス (2186) の情報を追加	Feb. 17, 2018, 10:37 a.m.