CVE-2010-2946

Priority
Low
Description
fs/jfs/xattr.c in the Linux kernel before 2.6.35.2 does not properly handle
a certain legacy format for storage of extended attributes, which might
allow local users by bypass intended xattr namespace restrictions via an
"os2." substring at the beginning of a name.
Ubuntu-Description
Sergey Vlasov discovered that JFS did not correctly handle certain extended
attributes. A local attacker could bypass namespace access rules, leading
to a loss of privacy.
References
Assigned-to
sconklin
Package
Upstream:needs-triage
Package
Upstream:needs-triage
Package
Upstream:needs-triage
Patches:
Dapper:http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2946/patches/dapper/linux/0001-jfs-don-t-allow-os2-xattr-namespace-overlap-with-other.txt
Package
Upstream:needs-triage
Package
Source: linux (LP Ubuntu Debian)
Upstream:needs-triage
Patches:
Hardy:http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2946/patches/hardy/linux/0001-jfs-don-t-allow-os2-xattr-namespace-overlap-with-other.txt
Jaunty:http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2946/patches/jaunty/linux/0001-jfs-don-t-allow-os2-xattr-namespace-overlap-with-other.txt
Karmic:http://chinstrap.ubuntu.com/~sconklin/CVEs/CVE-2010-2946/patches/karmic/linux/0001-jfs-don-t-allow-os2-xattr-namespace-overlap-with-other.txt
More Information

Valid XHTML 1.0 Strict

Updated: 2015-07-29 20:38:49 UTC (commit 9756)