Executive Summary

Informations
Name CVE-2010-3081 First vendor Publication 2010-09-24
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Overall CVSS Score 7.8
Base Score 7.8 Environmental Score 7.8
impact SubScore 5.9 Temporal Score 7.8
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact High
Integrity Impact High Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 7.2 Attack Range Local
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 3.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3081

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11894
 
Oval ID: oval:org.mitre.oval:def:11894
Title: DSA-2110-1 linux-2.6 -- privilege escalation/denial of service/information leak
Description: CVE-2010-2492 Andre Osterhues reported an issue in the eCryptfs subsystem. A buffer overflow condition may allow local users to cause a denial of service or gain elevated privileges. CVE-2010-2954 Tavis Ormandy reported an issue in the irda subsystem which may allow local users to cause a denial of service via a NULL pointer dereference. CVE-2010-3078 Dan Rosenberg discovered an issue in the XFS file system that allows local users to read potentially sensitive kernel memory. CVE-2010-3080 Tavis Ormandy reported an issue in the ALSA sequencer OSS emulation layer. Local users with sufficient privileges to open /dev/sequencer can cause a denial of service via a NULL pointer dereference. CVE-2010-3081 Ben Hawkes discovered an issue in the 32-bit compatibility code for 64-bit systems. Local users can gain elevated privileges due to insufficient checks in compat_alloc_user_space allocations. For the stable distribution, this problem has been fixed in version 2.6.26-25lenny1. We recommend that you upgrade your linux-2.6 and user-mode-linux packages. The following matrix lists additional source packages that were rebuilt for compatibility with or to take advantage of this update: Debian 5.0 user-mode-linux 2.6.26-1um-2+25lenny1
Family: unix Class: patch
Reference(s): DSA-2110-1
CVE-2010-2492
CVE-2010-2954
CVE-2010-3078
CVE-2010-3080
CVE-2010-3081
 Version: 5
Platform(s): Debian GNU/Linux 5.0
 Product(s): linux-2.6
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20529
 
Oval ID: oval:org.mitre.oval:def:20529
Title: Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
Description: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Family: unix Class: vulnerability
Reference(s): CVE-2010-3081
 Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22300
 
Oval ID: oval:org.mitre.oval:def:22300
Title: RHSA-2010:0704: kernel security update (Important)
Description: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Family: unix Class: patch
Reference(s): RHSA-2010:0704-01
CESA-2010:0704
CVE-2010-3081
 Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23170
 
Oval ID: oval:org.mitre.oval:def:23170
Title: ELSA-2010:0704: kernel security update (Important)
Description: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Family: unix Class: patch
Reference(s): ELSA-2010:0704-01
CVE-2010-3081
 Version: 6
Platform(s): Oracle Linux 5
 Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28053
 
Oval ID: oval:org.mitre.oval:def:28053
Title: DEPRECATED: ELSA-2010-0704 -- kernel security update (important)
Description: [2.6.18-194.11.4.0.1.el5] - [xen] check to see if hypervisor supports memory reservation change (Chuck Anderson) [orabug 7556514] - Add entropy support to igb (John Sobecki) [orabug 7607479] - [nfs] convert ENETUNREACH to ENOTCONN [orabug 7689332] - [NET] Add xen pv/bonding netconsole support (Tina Yang) [orabug 6993043] [bz 7258] - [mm] shrink_zone patch (John Sobecki,Chris Mason) [orabug 6086839] - fix aacraid not to reset during kexec (Joe Jin) [orabug 8516042] - [nfsd] fix failure of file creation from hpux client (Wen gang Wang) [orabug 7579314] - [qla] fix qla not to query hccr (Guru Anbalagane) [Orabug 8746702] - [net] bonding: fix xen+bonding+netconsole panic issue (Joe Jin) [orabug 9504524] - [rds] Patch rds to 1.4.2-14 (Andy Grover) [orabug 9471572, 9344105] RDS: Fix BUG_ONs to not fire when in a tasklet ipoib: Fix lockup of the tx queue RDS: Do not call set_page_dirty() with irqs off (Sherman Pun) RDS: Properly unmap when getting a remote access error (Tina Yang) RDS: Fix locking in rds_send_drop_to() - [mm] Enhance shrink_zone patch allow full swap utilization, and also be NUMA-aware (John Sobecki, Chris Mason, Herbert van den Bergh) [orabug 9245919] - [xen] PVHVM guest with PoD crashes under memory pressure (Chuck Anderson) [orabug 9107465] - [xen] PV guest with FC HBA hangs during shutdown (Chuck Anderson) [orabug 9764220] - Support 256GB+ memory for pv guest (Mukesh Rathor) [orabug 9450615] - fix overcommit memory to use percpu_counter for el5 (KOSAKI Motohiro, Guru Anbalagane) [orabug 6124033] - [ipmi] make configurable timeouts for kcs of ipmi [orabug 9752208] [2.6.18-194.11.4.el5] - [misc] make compat_alloc_user_space() incorporate the access_ok() (Don Howard) [634463 634464] {CVE-2010-3081}
Family: unix Class: patch
Reference(s): ELSA-2010-0704
CVE-2010-3081
 Version: 4
Platform(s): Oracle Linux 5
 Product(s): kernel
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Os 1332
Os 1
Os 1
Os 2

OpenVAS Exploits

Date Description
2012-03-16 Name : VMSA-2011-0003.2 Third party component updates for VMware vCenter Server, vCe...
File : nvt/gb_VMSA-2011-0003.nasl
2011-08-09 Name : CentOS Update for kernel CESA-2010:0704 centos5 i386
File : nvt/gb_CESA-2010_0704_kernel_centos5_i386.nasl
2011-06-24 Name : Fedora Update for kernel FEDORA-2011-6447
File : nvt/gb_fedora_2011_6447_kernel_fc13.nasl
2011-05-10 Name : Ubuntu Update for linux-ti-omap4 USN-1119-1
File : nvt/gb_ubuntu_USN_1119_1.nasl
2011-03-15 Name : Fedora Update for kernel FEDORA-2011-2134
File : nvt/gb_fedora_2011_2134_kernel_fc13.nasl
2011-01-11 Name : SuSE Update for kernel SUSE-SA:2010:047
File : nvt/gb_suse_2010_047.nasl
2010-12-28 Name : Fedora Update for kernel FEDORA-2010-18983
File : nvt/gb_fedora_2010_18983_kernel_fc13.nasl
2010-12-23 Name : Fedora Update for kernel FEDORA-2010-18506
File : nvt/gb_fedora_2010_18506_kernel_fc13.nasl
2010-12-09 Name : Fedora Update for kernel FEDORA-2010-18432
File : nvt/gb_fedora_2010_18432_kernel_fc12.nasl
2010-12-09 Name : Mandriva Update for kernel MDVSA-2010:247 (kernel)
File : nvt/gb_mandriva_MDVSA_2010_247.nasl
2010-12-02 Name : Fedora Update for kernel FEDORA-2010-14832
File : nvt/gb_fedora_2010_14832_kernel_fc14.nasl
2010-10-19 Name : Mandriva Update for kernel MDVSA-2010:198 (kernel)
File : nvt/gb_mandriva_MDVSA_2010_198.nasl
2010-10-10 Name : Debian Security Advisory DSA 2110-1 (linux-2.6)
File : nvt/deb_2110_1.nasl
2010-10-01 Name : RedHat Update for kernel RHSA-2010:0718-01
File : nvt/gb_RHSA-2010_0718-01_kernel.nasl
2010-10-01 Name : SuSE Update for kernel SUSE-SA:2010:043
File : nvt/gb_suse_2010_043.nasl
2010-10-01 Name : SuSE Update for kernel SUSE-SA:2010:046
File : nvt/gb_suse_2010_046.nasl
2010-10-01 Name : CentOS Update for kernel CESA-2010:0718 centos4 i386
File : nvt/gb_CESA-2010_0718_kernel_centos4_i386.nasl
2010-09-27 Name : Mandriva Update for kernel MDVSA-2010:188 (kernel)
File : nvt/gb_mandriva_MDVSA_2010_188.nasl
2010-09-27 Name : RedHat Update for kernel RHSA-2010:0704-01
File : nvt/gb_RHSA-2010_0704-01_kernel.nasl
2010-09-22 Name : Fedora Update for kernel FEDORA-2010-14878
File : nvt/gb_fedora_2010_14878_kernel_fc12.nasl
2010-09-22 Name : Fedora Update for kernel FEDORA-2010-14890
File : nvt/gb_fedora_2010_14890_kernel_fc13.nasl
2010-09-22 Name : Ubuntu Update for Linux kernel vulnerabilities USN-988-1
File : nvt/gb_ubuntu_USN_988_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
68213 Linux Kernel on 64-bit include/asm/compat.h compat_alloc_user_space Function ...

Information Assurance Vulnerability Management (IAVM)

Date Description
2011-05-12 IAVM : 2011-A-0066 - Multiple Vulnerabilities in VMware Products
Severity : Category I - VMSKEY : V0027158
2010-09-23 IAVM : 2010-B-0085 - Linux Kernel Privilege Escalation Vulnerability
Severity : Category I - VMSKEY : V0025410

Nessus® Vulnerability Scanner

Date Description
2016-03-08 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0017_remote.nasl - Type : ACT_GATHER_INFO
2016-03-04 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2011-0003_remote.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_kernel-100921.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0704.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0718.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0705.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0711.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0719.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100921_kernel_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20101110_kernel_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-05-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-7164.nasl - Type : ACT_GATHER_INFO
2011-06-13 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1119-1.nasl - Type : ACT_GATHER_INFO
2011-05-28 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2010-265-01.nasl - Type : ACT_GATHER_INFO
2011-02-14 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2011-0003.nasl - Type : ACT_GATHER_INFO
2011-01-21 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-101007.nasl - Type : ACT_GATHER_INFO
2011-01-21 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-100921.nasl - Type : ACT_GATHER_INFO
2010-12-06 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-247.nasl - Type : ACT_GATHER_INFO
2010-12-02 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-100920.nasl - Type : ACT_GATHER_INFO
2010-12-01 Name : The remote VMware ESX host is missing a security-related patch.
File : vmware_VMSA-2010-0017.nasl - Type : ACT_GATHER_INFO
2010-11-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0842.nasl - Type : ACT_GATHER_INFO
2010-10-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-7160.nasl - Type : ACT_GATHER_INFO
2010-10-08 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-198.nasl - Type : ACT_GATHER_INFO
2010-10-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0718.nasl - Type : ACT_GATHER_INFO
2010-10-06 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0718.nasl - Type : ACT_GATHER_INFO
2010-09-24 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_kernel-100921.nasl - Type : ACT_GATHER_INFO
2010-09-24 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_kernel-100921.nasl - Type : ACT_GATHER_INFO
2010-09-24 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-188.nasl - Type : ACT_GATHER_INFO
2010-09-23 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12646.nasl - Type : ACT_GATHER_INFO
2010-09-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0704.nasl - Type : ACT_GATHER_INFO
2010-09-22 Name : The remote Fedora host is missing a security update.
File : fedora_2010-14832.nasl - Type : ACT_GATHER_INFO
2010-09-22 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0704.nasl - Type : ACT_GATHER_INFO
2010-09-21 Name : The remote Fedora host is missing a security update.
File : fedora_2010-14890.nasl - Type : ACT_GATHER_INFO
2010-09-21 Name : The remote Fedora host is missing a security update.
File : fedora_2010-14878.nasl - Type : ACT_GATHER_INFO
2010-09-20 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-988-1.nasl - Type : ACT_GATHER_INFO
2010-09-20 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2110.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html
http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html
http://blog.ksplice.com/2010/09/cve-2010-3081/
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3...
http://isc.sans.edu/diary.html?storyid=9574
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
http://marc.info/?l=oss-security&m=128461522230211&w=2
http://secunia.com/advisories/42384
http://secunia.com/advisories/43315
http://sota.gen.nz/compat1/
http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc4-git2.log
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198
http://www.mandriva.com/security/advisories?name=MDVSA-2010:214
http://www.mandriva.com/security/advisories?name=MDVSA-2010:247
http://www.redhat.com/support/errata/RHSA-2010-0758.html
http://www.redhat.com/support/errata/RHSA-2010-0842.html
http://www.redhat.com/support/errata/RHSA-2010-0882.html
http://www.securityfocus.com/archive/1/514938/30/30/threaded
http://www.securityfocus.com/archive/1/516397/100/0/threaded
http://www.vmware.com/security/advisories/VMSA-2010-0017.html
http://www.vmware.com/security/advisories/VMSA-2011-0003.html
http://www.vupen.com/english/advisories/2010/3083
http://www.vupen.com/english/advisories/2010/3117
http://www.vupen.com/english/advisories/2011/0298
https://access.redhat.com/kb/docs/DOC-40265
https://bugzilla.redhat.com/show_bug.cgi?id=634457
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
Date Informations
2024-11-28 23:07:30
  • Multiple Updates
2024-11-28 12:22:40
  • Multiple Updates
2024-08-02 12:14:15
  • Multiple Updates
2024-08-02 01:03:52
  • Multiple Updates
2024-02-02 01:13:50
  • Multiple Updates
2024-02-01 12:03:48
  • Multiple Updates
2023-09-05 12:12:53
  • Multiple Updates
2023-09-05 01:03:39
  • Multiple Updates
2023-09-02 12:12:57
  • Multiple Updates
2023-09-02 01:03:42
  • Multiple Updates
2023-08-12 12:15:24
  • Multiple Updates
2023-08-12 01:03:41
  • Multiple Updates
2023-08-11 12:12:59
  • Multiple Updates
2023-08-11 01:03:49
  • Multiple Updates
2023-08-06 12:12:30
  • Multiple Updates
2023-08-06 01:03:43
  • Multiple Updates
2023-08-04 12:12:35
  • Multiple Updates
2023-08-04 01:03:44
  • Multiple Updates
2023-07-14 12:12:32
  • Multiple Updates
2023-07-14 01:03:42
  • Multiple Updates
2023-03-29 01:14:20
  • Multiple Updates
2023-03-28 12:03:48
  • Multiple Updates
2023-02-13 09:29:07
  • Multiple Updates
2023-02-02 17:28:13
  • Multiple Updates
2022-10-11 12:11:10
  • Multiple Updates
2022-10-11 01:03:29
  • Multiple Updates
2022-03-11 01:09:19
  • Multiple Updates
2021-05-04 12:11:57
  • Multiple Updates
2021-04-22 01:12:48
  • Multiple Updates
2020-08-11 21:23:01
  • Multiple Updates
2020-08-11 12:05:20
  • Multiple Updates
2020-08-08 01:05:23
  • Multiple Updates
2020-08-07 12:05:27
  • Multiple Updates
2020-08-07 01:05:28
  • Multiple Updates
2020-08-01 12:05:25
  • Multiple Updates
2020-07-30 01:05:35
  • Multiple Updates
2020-05-23 01:42:31
  • Multiple Updates
2020-05-23 00:26:19
  • Multiple Updates
2019-01-25 12:03:17
  • Multiple Updates
2018-11-17 12:01:48
  • Multiple Updates
2018-10-30 12:03:31
  • Multiple Updates
2018-10-11 00:19:55
  • Multiple Updates
2016-07-01 11:06:56
  • Multiple Updates
2016-06-29 00:14:38
  • Multiple Updates
2016-06-28 18:17:39
  • Multiple Updates
2016-04-26 20:02:00
  • Multiple Updates
2016-03-09 13:25:54
  • Multiple Updates
2016-03-05 13:26:42
  • Multiple Updates
2014-06-14 13:29:09
  • Multiple Updates
2014-02-17 10:56:58
  • Multiple Updates
2013-11-11 12:38:53
  • Multiple Updates
2013-05-10 23:30:48
  • Multiple Updates