Executive Summary

Informations
Name CVE-2010-4343 First vendor Publication 2010-12-29
Vendor Cve Last vendor Modification 2023-02-13

Security-Database Scoring CVSS v3

Cvss vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Overall CVSS Score 5.5
Base Score 5.5 Environmental Score 5.5
impact SubScore 3.6 Temporal Score 5.5
Exploitabality Sub Score 1.8
 
Attack Vector Local Attack Complexity Low
Privileges Required Low User Interaction None
Scope Unchanged Confidentiality Impact None
Integrity Impact None Availability Impact High
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:M/Au:N/C:N/I:N/A:C)
Cvss Base Score 4.7 Attack Range Local
Cvss Impact Score 6.9 Attack Complexity Medium
Cvss Expoit Score 3.4 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4343

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-665 Improper Initialization

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:20600
 
Oval ID: oval:org.mitre.oval:def:20600
Title: VMware ESX third party updates for Service Console packages glibc and dhcp
Description: drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.
Family: unix Class: vulnerability
Reference(s): CVE-2010-4343
Version: 4
Platform(s): VMWare ESX Server 4.1
VMWare ESX Server 4.0
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21526
 
Oval ID: oval:org.mitre.oval:def:21526
Title: RHSA-2011:0017: Red Hat Enterprise Linux 5.6 kernel security and bug fix update (Important)
Description: drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.
Family: unix Class: patch
Reference(s): RHSA-2011:0017-01
CVE-2010-3296
CVE-2010-3877
CVE-2010-4072
CVE-2010-4073
CVE-2010-4075
CVE-2010-4080
CVE-2010-4081
CVE-2010-4158
CVE-2010-4238
CVE-2010-4243
CVE-2010-4255
CVE-2010-4263
CVE-2010-4343
Version: 172
Platform(s): Red Hat Enterprise Linux 5
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22989
 
Oval ID: oval:org.mitre.oval:def:22989
Title: ELSA-2011:0017: Oracle Linux 5.x.6 kernel security and bug fix update (Important)
Description: drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.
Family: unix Class: patch
Reference(s): ELSA-2011:0017-01
CVE-2010-3296
CVE-2010-3877
CVE-2010-4072
CVE-2010-4073
CVE-2010-4075
CVE-2010-4080
CVE-2010-4081
CVE-2010-4158
CVE-2010-4238
CVE-2010-4243
CVE-2010-4255
CVE-2010-4263
CVE-2010-4343
Version: 57
Platform(s): Oracle Linux 5
Product(s): kernel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28199
 
Oval ID: oval:org.mitre.oval:def:28199
Title: DEPRECATED: ELSA-2011-0017 -- Oracle Linux 5.6 kernel security and bug fix update (important)
Description: This update fixes the following security issues: * A NULL pointer dereference flaw was found in the igb driver in the Linux kernel. If both the Single Root I/O Virtualization (SR-IOV) feature and promiscuous mode were enabled on an interface using igb, it could result in a denial of service when a tagged VLAN packet is received on that interface. (CVE-2010-4263, Important) * A missing sanity check was found in vbd_create() in the Xen hypervisor implementation. As CD-ROM drives are not supported by the blkback back-end driver, attempting to use a virtual CD-ROM drive with blkback could trigger a denial of service (crash) on the host system running the Xen hypervisor. (CVE-2010-4238, Moderate) * A flaw was found in the Linux kernel execve() system call implementation. A local, unprivileged user could cause large amounts of memory to be allocated but not visible to the OOM (Out of Memory) killer, triggering a denial of service. (CVE-2010-4243, Moderate) * A flaw was found in fixup_page_fault() in the Xen hypervisor implementation. If a 64-bit para-virtualized guest accessed a certain area of memory, it could cause a denial of service on the host system running the Xen hypervisor. (CVE-2010-4255, Moderate) * A missing initialization flaw was found in the bfa driver used by Brocade Fibre Channel Host Bus Adapters. A local, unprivileged user could use this flaw to cause a denial of service by reading a file in the "/sys/class/fc_host/host#/statistics/" directory. (CVE-2010-4343, Moderate) * Missing initialization flaws in the Linux kernel could lead to information leaks. (CVE-2010-3296, CVE-2010-3877, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4158, Low)
Family: unix Class: patch
Reference(s): ELSA-2011-0017
CVE-2010-3296
CVE-2010-3877
CVE-2010-4072
CVE-2010-4073
CVE-2010-4075
CVE-2010-4080
CVE-2010-4081
CVE-2010-4158
CVE-2010-4238
CVE-2010-4243
CVE-2010-4255
CVE-2010-4263
CVE-2010-4343
Version: 4
Platform(s): Oracle Linux 5
Product(s): kernel
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Os 1317
Os 2

OpenVAS Exploits

Date Description
2012-03-16 Name : VMSA-2011-0012.3 VMware ESXi and ESX updates to third party libraries and ESX...
File : nvt/gb_VMSA-2011-0012.nasl
2011-09-23 Name : RedHat Update for kernel RHSA-2011:1321-01
File : nvt/gb_RHSA-2011_1321-01_kernel.nasl
2011-05-06 Name : SuSE Update for kernel SUSE-SA:2011:020
File : nvt/gb_suse_2011_020.nasl
2011-03-07 Name : Ubuntu Update for linux vulnerabilities USN-1080-1
File : nvt/gb_ubuntu_USN_1080_1.nasl
2011-03-07 Name : Ubuntu Update for linux-ec2 vulnerabilities USN-1080-2
File : nvt/gb_ubuntu_USN_1080_2.nasl
2011-01-14 Name : RedHat Update for Red Hat Enterprise Linux 5.6 kernel RHSA-2011:0017-01
File : nvt/gb_RHSA-2011_0017-01_Red_Hat_Enterprise_Linux_5.6_kernel.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
70228 Linux Kernel drivers/scsi/bfa/bfa_core.c fc_host Statistics File Read Operati...

Linux Kernel contains a flaw that may allow a local denial of service. The issue is triggered when 'drivers/scsi/bfa/bfa_core.c' fails to initialize a certain port data structure, and will result in a denial of service via read operations on an fc_host statistics file.

Information Assurance Vulnerability Management (IAVM)

Date Description
2011-10-27 IAVM : 2011-A-0147 - Multiple Vulnerabilities in VMware ESX and ESXi
Severity : Category I - VMSKEY : V0030545

Nessus® Vulnerability Scanner

Date Description
2016-03-04 Name : The remote VMware ESX / ESXi host is missing a security-related patch.
File : vmware_VMSA-2011-0012_remote.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_kernel-110414.nasl - Type : ACT_GATHER_INFO
2013-11-13 Name : The remote VMware ESXi 5.0 host is affected by multiple security vulnerabilit...
File : vmware_esxi_5_0_build_515841_remote.nasl - Type : ACT_GATHER_INFO
2013-03-08 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1093-1.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-1321.nasl - Type : ACT_GATHER_INFO
2011-10-14 Name : The remote VMware ESXi / ESX host is missing one or more security-related pat...
File : vmware_VMSA-2011-0012.nasl - Type : ACT_GATHER_INFO
2011-03-03 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1080-2.nasl - Type : ACT_GATHER_INFO
2011-03-02 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1080-1.nasl - Type : ACT_GATHER_INFO
2011-01-14 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0017.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/45262
BUGTRAQ http://www.securityfocus.com/archive/1/520102/100/0/threaded
CONFIRM http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
https://bugzilla.redhat.com/show_bug.cgi?id=661182
MISC http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3...
MLIST http://www.openwall.com/lists/oss-security/2010/12/08/3
http://www.openwall.com/lists/oss-security/2010/12/09/15
http://www.spinics.net/lists/linux-scsi/msg43772.html
REDHAT http://www.redhat.com/support/errata/RHSA-2011-0017.html
SECUNIA http://secunia.com/advisories/42884
http://secunia.com/advisories/46397

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
Date Informations
2024-02-02 01:14:33
  • Multiple Updates
2024-02-01 12:04:03
  • Multiple Updates
2023-09-05 12:13:34
  • Multiple Updates
2023-09-05 01:03:55
  • Multiple Updates
2023-09-02 12:13:39
  • Multiple Updates
2023-09-02 01:03:58
  • Multiple Updates
2023-08-12 12:16:15
  • Multiple Updates
2023-08-12 01:03:58
  • Multiple Updates
2023-08-11 12:13:42
  • Multiple Updates
2023-08-11 01:04:06
  • Multiple Updates
2023-08-06 12:13:10
  • Multiple Updates
2023-08-06 01:04:00
  • Multiple Updates
2023-08-04 12:13:16
  • Multiple Updates
2023-08-04 01:04:00
  • Multiple Updates
2023-07-14 12:13:13
  • Multiple Updates
2023-07-14 01:03:58
  • Multiple Updates
2023-03-29 01:15:08
  • Multiple Updates
2023-03-28 12:04:04
  • Multiple Updates
2023-02-13 09:29:03
  • Multiple Updates
2022-10-11 12:11:47
  • Multiple Updates
2022-10-11 01:03:45
  • Multiple Updates
2022-03-11 01:09:47
  • Multiple Updates
2021-05-04 12:12:48
  • Multiple Updates
2021-04-22 01:14:37
  • Multiple Updates
2020-08-14 21:23:10
  • Multiple Updates
2020-08-11 12:05:38
  • Multiple Updates
2020-08-08 01:05:42
  • Multiple Updates
2020-08-07 12:05:47
  • Multiple Updates
2020-08-01 12:05:44
  • Multiple Updates
2020-07-30 01:05:57
  • Multiple Updates
2020-05-23 01:43:05
  • Multiple Updates
2020-05-23 00:26:57
  • Multiple Updates
2019-01-25 12:03:28
  • Multiple Updates
2018-11-17 12:01:59
  • Multiple Updates
2018-10-30 12:03:44
  • Multiple Updates
2018-10-11 00:20:01
  • Multiple Updates
2016-07-01 11:07:07
  • Multiple Updates
2016-06-29 00:16:26
  • Multiple Updates
2016-06-28 18:23:04
  • Multiple Updates
2016-04-26 20:15:08
  • Multiple Updates
2016-03-05 13:26:42
  • Multiple Updates
2014-06-14 13:29:47
  • Multiple Updates
2014-02-17 10:58:42
  • Multiple Updates
2013-11-11 12:39:06
  • Multiple Updates
2013-05-10 23:37:35
  • Multiple Updates