NVD

Id
15532  
Name
CVE-2010-4258  
Description
The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.  
Reject
 
CVSS Version
2  
CVSS Score
6.2  
Severity
Medium  
CVSS Base Score
6.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
1.9  
CVSS Vector
(AV:L/AC:H/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-18  
Published
2010-12-30  
Modified Date
2013-09-13  
Seq
2010-4258  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
87842 15532 CVE-2010-4258 20101207 Linux kernel exploit  View
87843 15532 CVE-2010-4258 http://blog.nelhage.com/2010/12/cve-2010-4258-from-dos-to-privesc/  View
87844 15532 CVE-2010-4258 http://code.google.com/p/chromium-os/issues/detail?id=10234  View
87845 15532 CVE-2010-4258 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=33dd94ae1ccbfb7bf0fb6c692bc3d1c4269e6177  View
87846 15532 CVE-2010-4258 http://googlechromereleases.blogspot.com/2011/01/chrome-os-beta-channel-update.html  View
87847 15532 CVE-2010-4258 FEDORA-2010-18983  View
87848 15532 CVE-2010-4258 SUSE-SA:2011:001  View
87849 15532 CVE-2010-4258 SUSE-SA:2011:002  View
87850 15532 CVE-2010-4258 SUSE-SA:2011:004  View
87851 15532 CVE-2010-4258 SUSE-SA:2011:005  View
87852 15532 CVE-2010-4258 SUSE-SA:2011:007  View
87853 15532 CVE-2010-4258 SUSE-SA:2011:008  View
87854 15532 CVE-2010-4258 [linux-kernel] 20101201 [PATCH v2] do_exit(): Make sure we run with get_fs() == USER_DS.  View
87855 15532 CVE-2010-4258 [oss-security] 20101202 CVE request: kernel: failure to revert address limit override in OOPS error path  View
87856 15532 CVE-2010-4258 [oss-security] 20101202 kernel: Dangerous interaction between clear_child_tid, set_fs(), and kernel oopses  View
87857 15532 CVE-2010-4258 [oss-security] 20101202 Re: kernel: Dangerous interaction between clear_child_tid, set_fs(), and kernel oopses  View
87858 15532 CVE-2010-4258 [oss-security] 20101202 Re: CVE request: kernel: failure to revert address limit override in OOPS error path  View
87859 15532 CVE-2010-4258 [oss-security] 20101208 Re: kernel: Dangerous interaction between clear_child_tid, set_fs(), and kernel oopses  View
87860 15532 CVE-2010-4258 [oss-security] 20101208 Re: kernel: Dangerous interaction between clear_child_tid, set_fs(), and kernel oopses  View
87861 15532 CVE-2010-4258 [oss-security] 20101208 Re: kernel: Dangerous interaction between clear_child_tid, set_fs(), and kernel oopses  View
87862 15532 CVE-2010-4258 [oss-security] 20101209 Re: kernel: Dangerous interaction between clear_child_tid, set_fs(), and kernel oopses  View
87863 15532 CVE-2010-4258 [oss-security] 20101209 Re: kernel: Dangerous interaction between clear_child_tid, set_fs(), and kernel oopses  View
87864 15532 CVE-2010-4258 http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2  View
87865 15532 CVE-2010-4258 MDVSA-2011:029  View
87866 15532 CVE-2010-4258 ADV-2010-3321  View
87867 15532 CVE-2010-4258 ADV-2011-0012  View
87868 15532 CVE-2010-4258 ADV-2011-0124  View
87869 15532 CVE-2010-4258 ADV-2011-0213  View
87870 15532 CVE-2010-4258 ADV-2011-0298  View
87871 15532 CVE-2010-4258 ADV-2011-0375  View
87872 15532 CVE-2010-4258 https://bugzilla.redhat.com/show_bug.cgi?id=659567  View
87873 15532 CVE-2010-4258 [linux-kernel] 20101201 Re: [PATCH v2] do_exit(): Make sure we run with get_fs() == USER_DS.  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36990 JVNDB-2010-002770 Linux kernel の kernel/exit.c 内にある do_exit 関数における権限を取得される脆弱性 Linux kernel の kernel/exit.c 内にある do_exit 関数は、KERNEL_DS get_fs 値を適切に処理しないため、access_ok の制限を回避され、任意のカーネルメモリのロケーションを上書きされたり、あるいは、権限を取得される脆弱性が存在します。 CVE-2010-4258 46838 CVE-2010-4258 15532 6.2 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002770.html 2010-12-09 2011-08-24 View