CVE-2010-2942 (retired)

Priority
Description
The actions implementation in the network queueing functionality in the
Linux kernel before 2.6.36-rc2 does not properly initialize certain
structure members when performing dump operations, which allows local users
to obtain potentially sensitive information from kernel memory via vectors
related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the
tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump
function in net/sched/act_nat.c, (4) the tcf_simp_dump function in
net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in
net/sched/act_skbedit.c.
Ubuntu-Description
Eric Dumazet discovered that many network functions could leak kernel stack
contents. A local attacker could exploit this to read portions of kernel
memory, leading to a loss of privacy.
Assigned-to
sconklin
Package
Upstream:released (2.6.36~rc2)
Package
Upstream:released (2.6.36~rc2)
Package
Upstream:released (2.6.36~rc2)
Package
Upstream:released (2.6.36~rc2)
More Information

Updated: 2019-03-26 11:52:37 UTC (commit ccdecfcf0fead22bd291e5f4ea745a46872dcb15)