CVE-2010-1636

The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the btrfs
functionality in the Linux kernel 2.6.29 through 2.6.32, and possibly other
versions, does not ensure that a cloned file descriptor has been opened for
reading, which allows local users to read sensitive information from a
write-only file descriptor.

Bugs

• <https://bugs.launchpad.net/ubuntu/+source/linux/+bug/579585&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=593226&gt;

Notes