CVE-2010-2955
The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 2.6.36-rc2 | 2.6.36-rc2.x |
| linux / linux_kernel | 2.6.36-rc1 | 2.6.36-rc1.x |
| linux / linux_kernel | - | 2.6.36 |
| linux / linux_kernel | 2.6.36 | 2.6.36.x |
| opensuse / opensuse | 11.1 | 11.1.x |
| suse / linux_enterprise_server | 11 | 11.x |
| suse / linux_enterprise_desktop | 11 | 11.x |
| suse / linux_enterprise_real_time_extension | 11-sp1 | 11-sp1.x |
| canonical / ubuntu_linux | 10.10 | 10.10.x |
| canonical / ubuntu_linux | 9.04 | 9.04.x |
| canonical / ubuntu_linux | 9.10 | 9.10.x |
| canonical / ubuntu_linux | 8.04 | 8.04.x |
| canonical / ubuntu_linux | 10.04 | 10.04.x |
| canonical / ubuntu_linux | 6.06 | 6.06.x |
- http://forums.grsecurity.net/viewtopic.php?f=3&t=2290
- http://git.kernel.org/?p=linux/kernel/git/linville/wireless-2.6.git%3Ba=commit%3Bh=42da2f948d949efd0111309f5827bf0298bcc9a4
- http://grsecurity.net/~spender/wireless-infoleak-fix2.patch
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- http://lkml.org/lkml/2010/8/27/413
- http://lkml.org/lkml/2010/8/30/127
- http://lkml.org/lkml/2010/8/30/146
- http://lkml.org/lkml/2010/8/30/351
- http://secunia.com/advisories/41245
- http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.36-rc3-next-20100831.bz2
- http://www.openwall.com/lists/oss-security/2010/08/31/1
- http://www.redhat.com/support/errata/RHSA-2010-0771.html
- http://www.redhat.com/support/errata/RHSA-2010-0842.html
- http://www.securityfocus.com/bid/42885
- http://www.ubuntu.com/usn/USN-1000-1
- http://www.vupen.com/english/advisories/2011/0298
- https://bugzilla.redhat.com/show_bug.cgi?id=628434
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime