This update fixes the following security issues :

  - Missing sanity checks in the Intel i915 driver in the     Linux kernel could allow a local, unprivileged user to     escalate their privileges. (CVE-2010-2962, Important)

  - compat_alloc_user_space() in the Linux kernel 32/64-bit     compatibility layer implementation was missing sanity     checks. This function could be abused in other areas of     the Linux kernel if its length argument can be     controlled from user-space. On 64-bit systems, a local,     unprivileged user could use this flaw to escalate their     privileges. (CVE-2010-3081, Important)

  - A buffer overflow flaw in niu_get_ethtool_tcam_all() in     the niu Ethernet driver in the Linux kernel, could allow     a local user to cause a denial of service or escalate     their privileges. (CVE-2010-3084, Important)

  - A flaw in the IA32 system call emulation provided in     64-bit Linux kernels could allow a local user to     escalate their privileges. (CVE-2010-3301, Important)

  - A flaw in sctp_packet_config() in the Linux kernel's     Stream Control Transmission Protocol (SCTP)     implementation could allow a remote attacker to cause a     denial of service. (CVE-2010-3432, Important)

  - A missing integer overflow check in snd_ctl_new() in the     Linux kernel's sound subsystem could allow a local,     unprivileged user on a 32-bit system to cause a denial     of service or escalate their privileges. (CVE-2010-3442,     Important)

  - A flaw was found in sctp_auth_asoc_get_hmac() in the     Linux kernel's SCTP implementation. When iterating     through the hmac_ids array, it did not reset the last id     element if it was out of range. This could allow a     remote attacker to cause a denial of service.
    (CVE-2010-3705, Important)

  - A function in the Linux kernel's Reliable Datagram     Sockets (RDS) protocol implementation was missing sanity     checks, which could allow a local, unprivileged user to     escalate their privileges. (CVE-2010-3904, Important)

  - A flaw in drm_ioctl() in the Linux kernel's Direct     Rendering Manager (DRM) implementation could allow a     local, unprivileged user to cause an information leak.
    (CVE-2010-2803, Moderate)

  - It was found that wireless drivers might not always     clear allocated buffers when handling a driver-specific     IOCTL information request. A local user could trigger     this flaw to cause an information leak. (CVE-2010-2955,     Moderate)

  - A NULL pointer dereference flaw in ftrace_regex_lseek()     in the Linux kernel's ftrace implementation could allow     a local, unprivileged user to cause a denial of service.
    Note: The debugfs file system must be mounted locally to     exploit this issue. It is not mounted by default.
    (CVE-2010-3079, Moderate)

  - A flaw in the Linux kernel's packet writing driver could     be triggered via the PKT_CTRL_CMD_STATUS IOCTL request,     possibly allowing a local, unprivileged user with access     to '/dev/pktcdvd/control' to cause an information leak.
    Note: By default, only users in the cdrom group have     access to '/dev/pktcdvd/control'. (CVE-2010-3437,     Moderate)

  - A flaw was found in the way KVM (Kernel-based Virtual     Machine) handled the reloading of fs and gs segment     registers when they had invalid selectors. A privileged     host user with access to '/dev/kvm' could use this flaw     to crash the host. (CVE-2010-3698, Moderate)

This update also fixes several bugs.

The system must be rebooted for this update to take effect.

Dan Rosenberg discovered that the RDS network protocol did not correctly check certain parameters. A local attacker could exploit this gain root privileges. (CVE-2010-3904)

Al Viro discovered a race condition in the TTY driver. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2009-4895)

Dan Rosenberg discovered that the MOVE_EXT ext4 ioctl did not correctly check file permissions. A local attacker could overwrite append-only files, leading to potential data loss. (CVE-2010-2066)

Dan Rosenberg discovered that the swapexit xfs ioctl did not correctly check file permissions. A local attacker could exploit this to read from write-only files, leading to a loss of privacy. (CVE-2010-2226)

Suresh Jayaraman discovered that CIFS did not correctly validate certain response packats. A remote attacker could send specially crafted traffic that would crash the system, leading to a denial of service. (CVE-2010-2248)

Ben Hutchings discovered that the ethtool interface did not correctly check certain sizes. A local attacker could perform malicious ioctl calls that could crash the system, leading to a denial of service.
(CVE-2010-2478, CVE-2010-3084)

James Chapman discovered that L2TP did not correctly evaluate checksum capabilities. If an attacker could make malicious routing changes, they could crash the system, leading to a denial of service.
(CVE-2010-2495)

Neil Brown discovered that NFSv4 did not correctly check certain write requests. A remote attacker could send specially crafted traffic that could crash the system or possibly gain root privileges.
(CVE-2010-2521)

David Howells discovered that DNS resolution in CIFS could be spoofed.
A local attacker could exploit this to control DNS replies, leading to a loss of privacy and possible privilege escalation. (CVE-2010-2524)

Dan Rosenberg discovered a flaw in gfs2 file system's handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system. (CVE-2010-2525)

Bob Peterson discovered that GFS2 rename operations did not correctly validate certain sizes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-2798)

Eric Dumazet discovered that many network functions could leak kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. (CVE-2010-2942, CVE-2010-3477)

Sergey Vlasov discovered that JFS did not correctly handle certain extended attributes. A local attacker could bypass namespace access rules, leading to a loss of privacy. (CVE-2010-2946)

Tavis Ormandy discovered that the IRDA subsystem did not correctly shut down. A local attacker could exploit this to cause the system to crash or possibly gain root privileges. (CVE-2010-2954)

Brad Spengler discovered that the wireless extensions did not correctly validate certain request sizes. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. (CVE-2010-2955)

Tavis Ormandy discovered that the session keyring did not correctly check for its parent. On systems without a default session keyring, a local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-2960)

Kees Cook discovered that the V4L1 32bit compat interface did not correctly validate certain parameters. A local attacker on a 64bit system with access to a video device could exploit this to gain root privileges. (CVE-2010-2963)

Toshiyuki Okajima discovered that ext4 did not correctly check certain parameters. A local attacker could exploit this to crash the system or overwrite the last block of large files. (CVE-2010-3015)

Tavis Ormandy discovered that the AIO subsystem did not correctly validate certain parameters. A local attacker could exploit this to crash the system or possibly gain root privileges. (CVE-2010-3067)

Dan Rosenberg discovered that certain XFS ioctls leaked kernel stack contents. A local attacker could exploit this to read portions of kernel memory, leading to a loss of privacy. (CVE-2010-3078)

Tavis Ormandy discovered that the OSS sequencer device did not correctly shut down. A local attacker could exploit this to crash the system or possibly gain root privileges. (CVE-2010-3080)

Dan Rosenberg discovered that the ROSE driver did not correctly check parameters. A local attacker with access to a ROSE network device could exploit this to crash the system or possibly gain root privileges. (CVE-2010-3310)

Thomas Dreibholz discovered that SCTP did not correctly handle appending packet chunks. A remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2010-3432)

Dan Rosenberg discovered that the CD driver did not correctly check parameters. A local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy. (CVE-2010-3437)

Dan Rosenberg discovered that the Sound subsystem did not correctly validate parameters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2010-3442)

Dan Rosenberg discovered that SCTP did not correctly handle HMAC calculations. A remote attacker could send specially crafted traffic that would crash the system, leading to a denial of service.
(CVE-2010-3705)

Joel Becker discovered that OCFS2 did not correctly validate on-disk symlink structures. If an attacker were able to trick a user or automated system into mounting a specially crafted filesystem, it could crash the system or expose kernel memory, leading to a loss of privacy. (CVE-2010-NNN2).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
60893	Scientific Linux Security Update : kernel on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2023/5/14	high
50044	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS / 10.10 : linux, linux-ec2, linux-source-2.6.15 vulnerabilities (USN-1000-1)	Nessus	Ubuntu Local Security Checks	2010/10/20	2023/5/14	critical

检测

插件搜索

high

critical