8.1 High
AI Score
Confidence
High
7.8 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
0.063 Low
EPSS
Percentile
93.5%
Gleb Napatov discovered that KVM did not correctly check certain privileged
operations. A local attacker with access to a guest kernel could exploit
this to crash the host system, leading to a denial of service.
(CVE-2010-0435)
Dan Rosenberg discovered that the Linux kernel TIPC implementation
contained multiple integer signedness errors. A local attacker could
exploit this to gain root privileges. (CVE-2010-3859)
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Dan Rosenberg discovered that the CAN protocol on 64bit systems did not
correctly calculate the size of certain buffers. A local attacker could
exploit this to crash the system or possibly execute arbitrary code as the
root user. (CVE-2010-3874)
Vasiliy Kulikov discovered that kvm did not correctly clear memory. A local
attacker could exploit this to read portions of the kernel stack, leading
to a loss of privacy. (CVE-2010-3881)
Dan Rosenberg discovered that IPC structures were not correctly initialized
on 64bit systems. A local attacker could exploit this to read kernel stack
memory, leading to a loss of privacy. (CVE-2010-4073)
Dan Rosenberg discovered that the ivtv V4L driver did not correctly
initialize certian structures. A local attacker could exploit this to read
kernel stack memory, leading to a loss of privacy. (CVE-2010-4079)
Dan Rosenberg discovered that the semctl syscall did not correctly clear
kernel memory. A local attacker could exploit this to read kernel stack
memory, leading to a loss of privacy. (CVE-2010-4083)
Dan Rosenberg discovered that the socket filters did not correctly
initialize structure memory. A local attacker could create malicious
filters to read portions of kernel stack memory, leading to a loss of
privacy. (CVE-2010-4158)
Dan Rosenberg discovered that the Linux kernel L2TP implementation
contained multiple integer signedness errors. A local attacker could
exploit this to to crash the kernel, or possibly gain root privileges.
(CVE-2010-4160)
Dan Rosenberg discovered that certain iovec operations did not calculate
page counts correctly. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-4162)
Dan Rosenberg discovered multiple flaws in the X.25 facilities parsing. If
a system was using X.25, a remote attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-4164)
Steve Chen discovered that setsockopt did not correctly check MSS values. A
local attacker could make a specially crafted socket call to crash the
system, leading to a denial of service. (CVE-2010-4165)
Dave Jones discovered that the mprotect system call did not correctly
handle merged VMAs. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-4169)
Dan Rosenberg discovered that the RDS protocol did not correctly check
ioctl arguments. A local attacker could exploit this to crash the system,
leading to a denial of service. (CVE-2010-4175)
Brad Spengler discovered that the kernel did not correctly account for
userspace memory allocations during exec() calls. A local attacker could
exploit this to consume all system memory, leading to a denial of service.
(CVE-2010-4243)
Vegard Nossum discovered that memory garbage collection was not handled
correctly for active sockets. A local attacker could exploit this to
allocate all available kernel memory, leading to a denial of service.
(CVE-2010-4249)
It was discovered that named pipes did not correctly handle certain fcntl
calls. A local attacker could exploit this to crash the system, leading to
a denial of service. (CVE-2010-4256)
Nelson Elhage discovered that the kernel did not correctly handle process
cleanup after triggering a recoverable kernel bug. If a local attacker were
able to trigger certain kinds of kernel bugs, they could create a specially
crafted process to gain root privileges. (CVE-2010-4258)
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 10.10 | noarch | linux-image-2.6.35-25-virtual | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | block-modules-2.6.35-25-generic-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | block-modules-2.6.35-25-virtual-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | char-modules-2.6.35-25-generic-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | crypto-modules-2.6.35-25-generic-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | crypto-modules-2.6.35-25-virtual-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | fat-modules-2.6.35-25-generic-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | fat-modules-2.6.35-25-virtual-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | fb-modules-2.6.35-25-generic-di | < 2.6.35-25.44 | UNKNOWN |
Ubuntu | 10.10 | noarch | fb-modules-2.6.35-25-virtual-di | < 2.6.35-25.44 | UNKNOWN |
ubuntu.com/security/CVE-2010-0435
ubuntu.com/security/CVE-2010-3859
ubuntu.com/security/CVE-2010-3873
ubuntu.com/security/CVE-2010-3874
ubuntu.com/security/CVE-2010-3881
ubuntu.com/security/CVE-2010-4073
ubuntu.com/security/CVE-2010-4079
ubuntu.com/security/CVE-2010-4083
ubuntu.com/security/CVE-2010-4158
ubuntu.com/security/CVE-2010-4160
ubuntu.com/security/CVE-2010-4162
ubuntu.com/security/CVE-2010-4164
ubuntu.com/security/CVE-2010-4165
ubuntu.com/security/CVE-2010-4169
ubuntu.com/security/CVE-2010-4175
ubuntu.com/security/CVE-2010-4243
ubuntu.com/security/CVE-2010-4249
ubuntu.com/security/CVE-2010-4256
ubuntu.com/security/CVE-2010-4258