製品・ソフトウェアに関する情報

JVN脆弱性詳細

Linux kernel の kernel/exit.c 内にある do_exit 関数における権限を取得される脆弱性

タイトル	Linux kernel の kernel/exit.c 内にある do_exit 関数における権限を取得される脆弱性
概要	Linux kernel の kernel/exit.c 内にある do_exit 関数は、KERNEL_DS get_fs 値を適切に処理しないため、access_ok の制限を回避され、任意のカーネルメモリのロケーションを上書きされたり、あるいは、権限を取得される脆弱性が存在します。
想定される影響	ローカルユーザにより、(1) BUG、(2) NULL ポインタのデリファレンス、または (3) ページフォルトを介して、access_ok の制限を回避され、任意のカーネルメモリのロケーションを上書きされたり、あるいは、権限を取得される可能性があります。
対策	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
公表日	2010年12月9日0:00
登録日	2011年3月23日15:29
最終更新日	2011年8月24日10:11

CVSS2.0 : 警告
スコア	6.2
ベクター	AV:L/AC:H/Au:N/C:C/I:C/A:C

影響を受けるシステム

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

Linux

Linux Kernel 2.6.36.2 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-4258	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4258
National Vulnerability Database (NVD)
2	CVE-2010-4258	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4258

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	名前	URL
Asianux Technical Support Network
1	kernel-2.6.18-194.11.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1420
2	kernel-2.6.18-194.13.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1464
Linux Kernel
3	ChangeLog-2.6.36.2	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2
MIRACLE LINUX アップデート情報
4	2183	http://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2183

変更履歴

No	変更内容	変更日
0	[2011年03月23日] 掲載 [2011年05月06日] 影響を受けるシステム：ミラクル・リナックス (kernel-2.6.18-194.11.AXS3) の情報を追加ベンダ情報：ミラクル・リナックス (kernel-2.6.18-194.11.AXS3) を追加 [2011年08月24日] 　ベンダ情報：ミラクル・リナックス (kernel-2.6.18-194.11.AXS3) を更新ベンダ情報：ミラクル・リナックス (kernel-2.6.18-194.13.AXS3) を追加	2018年2月17日10:37

NVD脆弱性情報

CVE-2010-4258

概要	The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.
公表日	2010年12月31日4:00
登録日	2021年1月29日11:08
最終更新日	2024年11月21日10:20

影響を受けるソフトウェアの構成

構成1		以上	以下	より上	未満
cpe:2.3:o:linux:linux_kernel::::::::					2.6.36.2

構成2		以上	以下	より上	未満
cpe:2.3:o:fedoraproject:fedora:13:::::::*

構成3	以上	以下	より上	未満
cpe:2.3:o:suse:linux_enterprise_server:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:9:::::::*
cpe:2.3:o:opensuse:opensuse:11.2:::::::*
cpe:2.3:o:opensuse:opensuse:11.3:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp1::::::

関連情報、対策とツール

No	URL	タグ
1	http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0086.html	Broken Link
2	http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0086.html	Broken Link
3	http://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-privesc/	Third Party Advisory
4	http://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-privesc/	Third Party Advisory
5	http://code.google.com/p/chromium-os/issues/detail?id=10234	Third Party Advisory
6	http://code.google.com/p/chromium-os/issues/detail?id=10234	Third Party Advisory
7	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177
8	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177
9	http://googlechromereleases.blogspot.com/2011/01/chrome-os-beta-channel-update.html	Third Party Advisory
10	http://googlechromereleases.blogspot.com/2011/01/chrome-os-beta-channel-update.html	Third Party Advisory
11	http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html	Third Party Advisory
12	http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052513.html	Third Party Advisory
13	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html	Mailing List Third Party Advisory
14	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00000.html	Mailing List Third Party Advisory
15	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html	Mailing List Third Party Advisory
16	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00001.html	Mailing List Third Party Advisory
17	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.html	Mailing List Third Party Advisory
18	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.html	Mailing List Third Party Advisory
19	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.html	Mailing List Third Party Advisory
20	http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.html	Mailing List Third Party Advisory
21	http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html	Mailing List Third Party Advisory
22	http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html	Mailing List Third Party Advisory
23	http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html	Mailing List Third Party Advisory
24	http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00002.html	Mailing List Third Party Advisory
25	http://marc.info/?l=linux-kernel&m=129117048916957&w=2	Patch Third Party Advisory
26	http://marc.info/?l=linux-kernel&m=129117048916957&w=2	Patch Third Party Advisory
27	http://openwall.com/lists/oss-security/2010/12/02/2	Mailing List Third Party Advisory
28	http://openwall.com/lists/oss-security/2010/12/02/2	Mailing List Third Party Advisory
29	http://openwall.com/lists/oss-security/2010/12/02/3	Mailing List Third Party Advisory
30	http://openwall.com/lists/oss-security/2010/12/02/3	Mailing List Third Party Advisory
31	http://openwall.com/lists/oss-security/2010/12/02/4	Mailing List Third Party Advisory
32	http://openwall.com/lists/oss-security/2010/12/02/4	Mailing List Third Party Advisory
33	http://openwall.com/lists/oss-security/2010/12/02/7	Mailing List Third Party Advisory
34	http://openwall.com/lists/oss-security/2010/12/02/7	Mailing List Third Party Advisory
35	http://openwall.com/lists/oss-security/2010/12/08/4	Mailing List Third Party Advisory
36	http://openwall.com/lists/oss-security/2010/12/08/4	Mailing List Third Party Advisory
37	http://openwall.com/lists/oss-security/2010/12/08/5	Mailing List Third Party Advisory
38	http://openwall.com/lists/oss-security/2010/12/08/5	Mailing List Third Party Advisory
39	http://openwall.com/lists/oss-security/2010/12/08/9	Mailing List Third Party Advisory
40	http://openwall.com/lists/oss-security/2010/12/08/9	Mailing List Third Party Advisory
41	http://openwall.com/lists/oss-security/2010/12/09/14	Mailing List Third Party Advisory
42	http://openwall.com/lists/oss-security/2010/12/09/14	Mailing List Third Party Advisory
43	http://openwall.com/lists/oss-security/2010/12/09/4	Mailing List Third Party Advisory
44	http://openwall.com/lists/oss-security/2010/12/09/4	Mailing List Third Party Advisory
45	http://secunia.com/advisories/42745	Third Party Advisory
46	http://secunia.com/advisories/42745	Third Party Advisory
47	http://secunia.com/advisories/42778	Third Party Advisory
48	http://secunia.com/advisories/42778	Third Party Advisory
49	http://secunia.com/advisories/42801	Third Party Advisory
50	http://secunia.com/advisories/42801	Third Party Advisory
51	http://secunia.com/advisories/42932	Third Party Advisory
52	http://secunia.com/advisories/42932	Third Party Advisory
53	http://secunia.com/advisories/43056	Third Party Advisory
54	http://secunia.com/advisories/43056	Third Party Advisory
55	http://secunia.com/advisories/43291	Third Party Advisory
56	http://secunia.com/advisories/43291	Third Party Advisory
57	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2	Broken Link
58	http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2	Broken Link
59	http://www.mandriva.com/security/advisories?name=MDVSA-2011:029	Third Party Advisory
60	http://www.mandriva.com/security/advisories?name=MDVSA-2011:029	Third Party Advisory
61	http://www.vupen.com/english/advisories/2010/3321	Third Party Advisory
62	http://www.vupen.com/english/advisories/2010/3321	Third Party Advisory
63	http://www.vupen.com/english/advisories/2011/0012	Third Party Advisory
64	http://www.vupen.com/english/advisories/2011/0012	Third Party Advisory
65	http://www.vupen.com/english/advisories/2011/0124	Third Party Advisory
66	http://www.vupen.com/english/advisories/2011/0124	Third Party Advisory
67	http://www.vupen.com/english/advisories/2011/0213	Third Party Advisory
68	http://www.vupen.com/english/advisories/2011/0213	Third Party Advisory
69	http://www.vupen.com/english/advisories/2011/0298	Third Party Advisory
70	http://www.vupen.com/english/advisories/2011/0298	Third Party Advisory
71	http://www.vupen.com/english/advisories/2011/0375	Third Party Advisory
72	http://www.vupen.com/english/advisories/2011/0375	Third Party Advisory
73	https://bugzilla.redhat.com/show_bug.cgi?id=659567	Issue Tracking Third Party Advisory
74	https://bugzilla.redhat.com/show_bug.cgi?id=659567	Issue Tracking Third Party Advisory
75	https://lkml.org/lkml/2010/12/1/543	Mailing List Patch Third Party Advisory
76	https://lkml.org/lkml/2010/12/1/543	Mailing List Patch Third Party Advisory

共通脆弱性一覧

No	CWE	名前	URL
1	CWE-269	不適切な権限管理	https://cwe.mitre.org/data/definitions/269.html

構成3	以上	以下	より上	未満
cpe:2.3:o:suse:linux_enterprise_server:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:9:::::::*
cpe:2.3:o:opensuse:opensuse:11.2:::::::*
cpe:2.3:o:opensuse:opensuse:11.3:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp3::::::
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp1::::::