CVE-2010-3081

Priority
High
Description
The compat_alloc_user_space functions in include/asm/compat.h files in the
Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly
allocate the userspace memory required for the 32-bit compatibility layer,
which allows local users to gain privileges by leveraging the ability of
the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt
support) to control a certain length value, related to a "stack pointer
underflow" issue, as exploited in the wild in September 2010.
Ubuntu-Description
Ben Hawkes discovered that the Linux kernel did not correctly validate
memory ranges on 64bit kernels when allocating memory on behalf of 32bit
system calls. On a 64bit system, a local attacker could perform malicious
multicast getsockopt calls to gain root privileges.
References
Assigned-to
smb
Package
Upstream:released (2.6.36~rc5)
Package
Upstream:released (2.6.36~rc5)
Patches:
Dapper:http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3081/patches/dapper/linux/0001-compat-Make-compat_alloc_user_space-incorporate-the-ac.txt
Package
Upstream:released (2.6.36~rc5)
Package
Source: linux (LP Ubuntu Debian)
Upstream:released (2.6.36~rc5)
Patches:
Upstream:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=c41d68a513c71e35a14f66d71782d27a79a81ea6
Hardy:http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3081/patches/hardy/linux/0001-compat-Make-compat_alloc_user_space-incorporate-the-ac.txt
Jaunty:http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3081/patches/jaunty/linux/0001-compat-Make-compat_alloc_user_space-incorporate-the-ac.txt
Karmic:http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3081/patches/karmic/linux/0001-compat-Make-compat_alloc_user_space-incorporate-the-ac.txt
Lucid:http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-3081/patches/lucid/linux/0001-compat-Make-compat_alloc_user_space-incorporate-the-ac.txt
More Information

Updated: 2018-06-26 04:37:24 UTC (commit 7799c934cca373482531a7b00e4dfe82302ceae5)