CVE-2010-4074
6.8 Medium
AI Score
Confidence
High
1.9 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
9.3%
The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.
| CPE | Name | Operator | Version |
|---|---|---|---|
| linux:linux_kernel | linux linux kernel | eq | 2.6.36 |
| debian:debian_linux | debian debian linux | eq | 5.0 |
References
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098
lkml.org/lkml/2010/9/15/392
secunia.com/advisories/42890
www.debian.org/security/2010/dsa-2126
www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5
www.openwall.com/lists/oss-security/2010/09/25/2
www.openwall.com/lists/oss-security/2010/10/06/6
www.openwall.com/lists/oss-security/2010/10/07/1
www.openwall.com/lists/oss-security/2010/10/25/3
www.redhat.com/support/errata/RHSA-2010-0958.html
www.redhat.com/support/errata/RHSA-2011-0007.html
www.securityfocus.com/bid/45074
bugzilla.redhat.com/show_bug.cgi?id=648659
Related
6.8 Medium
AI Score
Confidence
High
1.9 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:N/A:N
0.0004 Low
EPSS
Percentile
9.3%