vendor:
Linux Kernel
by:
Jon Oberheide
7.5
CVSS
HIGH
Kernel Memory Disclosure
416
CWE
Product Name: Linux Kernel
Affected Version From: < 2.6.36-rc6
Affected Version To:
Patch Exists: NO
Related CWE: CVE-2010-3437
CPE: o:linux:linux_kernel
Platforms Tested: Ubuntu Lucid 10.04 (32-bit)
2010
Linux Kernel < 2.6.36-rc6 pktcdvd Kernel Memory Disclosure
The PKT_CTRL_CMD_STATUS device ioctl retrieves a pointer to a pktcdvd_device from the global pkt_devs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index. This allows an attacker to disclose 4 bytes of arbitrary kernel memory per ioctl call by specifying a large negative device index, causing the kernel to dereference to our fake pktcdvd_device structure in userspace and copy data to userspace from an attacker-controlled address.
Mitigation:
Upgrade to Linux Kernel version 2.6.36-rc6 or later.