CVE-2010-2798 The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users...
HighCVSS 7.8
EPSS 0.41%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | < 2.6.35 | 2.6.35 |
| VMware ESX | = 4.0 | No fix listed |
| VMware ESX | = 4.1 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 8.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.04 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| debian linux | = 5.0 | No fix listed |
| avaya aura communication manager | = 5.2 | No fix listed |
| avaya aura presence services | = 6.0 | No fix listed |
| avaya aura presence services | = 6.1 | No fix listed |
| avaya aura presence services | = 6.1.1 | No fix listed |
| avaya aura session manager | = 1.1 | No fix listed |
| avaya aura session manager | = 5.2 | No fix listed |
| avaya aura session manager | = 6.0 | No fix listed |
| avaya aura system manager | = 5.2 | No fix listed |
| avaya aura system manager | = 6.0 | No fix listed |
| avaya aura system manager | = 6.1 | No fix listed |
| avaya aura system manager | = 6.1.1 | No fix listed |
| avaya aura system platform | = 1.1 | No fix listed |
| avaya aura system platform | = 6.0 | No fix listed |
| avaya aura system platform | = 6.0-sp1 | No fix listed |
| avaya iq | = 5.0 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya iq | = 5.1 | No fix listed |
| avaya voice portal | = 5.0 | No fix listed |
| avaya voice portal | = 5.1 | No fix listed |
| avaya voice portal | = 5.1-sp1 | No fix listed |
| opensuse | = 11.1 | No fix listed |
| SUSE linux enterprise high availability extension | = 11 | No fix listed |
| SUSE linux enterprise high availability extension | = 11-sp1 | No fix listed |
| suse linux enterprise desktop | = 11 | No fix listed |
| suse linux enterprise desktop | = 11-sp1 | No fix listed |
| suse linux enterprise server | = 11 | No fix listed |
| suse linux enterprise server | = 11-sp1 | No fix listed |
References
- git.kernel.org
- SUSE-SA:2010:040 mailing-list third-party-advisory vendor-advisory
- SUSE-SA:2010:054 mailing-list third-party-advisory vendor-advisory
- 46397 broken-link third-party-advisory
- 1024386 third-party-advisory vdb-entry
- support.avaya.com third-party-advisory
- DSA-2094 third-party-advisory vendor-advisory
- www.kernel.org broken-link
- MDVSA-2010:198 broken-link vendor-advisory
- [oss-security] 20100802 CVE request: kernel: gfs2: rename cases kernel panic mailing-list patch third-party-advisory
- [oss-security] 20100802 Re: CVE request: kernel: gfs2: rename cases kernel panic mailing-list patch third-party-advisory
- RHSA-2010:0660 broken-link vendor-advisory
- RHSA-2010:0670 broken-link vendor-advisory
- RHSA-2010:0723 broken-link vendor-advisory
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list third-party-advisory vdb-entry
- 42124 third-party-advisory vdb-entry
- USN-1000-1 third-party-advisory vendor-advisory
- www.vmware.com third-party-advisory
- bugzilla.redhat.com issue-tracking patch third-party-advisory