CVE-2010-2943 The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read....
HighCVSS 8.1
EPSS 17.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | < 2.6.35 | 2.6.35 |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 9.10 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 10.10 | No fix listed |
| VMware ESX | = 4.0 | No fix listed |
| VMware ESX | = 4.1 | No fix listed |
| avaya aura communication manager | = 5.2 | No fix listed |
| avaya aura presence services | = 6.0 | No fix listed |
| avaya aura presence services | = 6.1 | No fix listed |
| avaya aura presence services | = 6.1.1 | No fix listed |
| avaya aura session manager | = 1.1 | No fix listed |
| avaya aura session manager | = 5.2 | No fix listed |
| avaya aura session manager | = 6.0 | No fix listed |
| avaya aura system manager | = 5.2 | No fix listed |
| avaya aura system manager | = 6.0 | No fix listed |
| avaya aura system manager | = 6.1 | No fix listed |
| avaya aura system manager | = 6.1.1 | No fix listed |
| avaya aura system platform | = 1.1 | No fix listed |
| avaya aura system platform | = 6.0 | No fix listed |
| avaya aura system platform | = 6.0-sp1 | No fix listed |
| avaya aura voice portal | = 5.0 | No fix listed |
| avaya aura voice portal | = 5.1 | No fix listed |
| avaya aura voice portal | = 5.1-sp1 | No fix listed |
| avaya iq | = 5.0 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya iq | = 5.1 | No fix listed |
References
- [linux-xfs] 20100620 [PATCH 0/4, V2] xfs: validate inode numbers in file handles correctly broken-link mailing-list
- [linux-xfs] 20100620 [PATCH 3/4] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED broken-link mailing-list
- [linux-xfs] 20100620 [PATCH 4/4] xfs: remove block number from inode lookup code broken-link mailing-list
- [linux-xfs] 20100620 [PATCH 2/4] xfs: validate untrusted inode numbers during lookup broken-link mailing-list
- git.kernel.org
- git.kernel.org
- git.kernel.org
- [xfs] 20100617 [PATCH] xfsqa: test open_by_handle() on unlinked and freed inode clusters V2 broken-link mailing-list
- [xfs] 20100618 Re: [PATCH] xfsqa: test open_by_handle() on unlinked and freed inode clusters V2 broken-link mailing-list
- 42758 broken-link third-party-advisory
- 43161 broken-link third-party-advisory
- 46397 broken-link third-party-advisory
- support.avaya.com third-party-advisory
- www.kernel.org broken-link
- [oss-security] 20100818 CVE request - kernel: xfs: stale data exposure mailing-list patch third-party-advisory
- [oss-security] 20100819 Re: CVE request - kernel: xfs: stale data exposure mailing-list patch third-party-advisory
- RHSA-2010:0723 broken-link vendor-advisory
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list third-party-advisory vdb-entry
- 42527 exploit third-party-advisory vdb-entry
- USN-1041-1 third-party-advisory vendor-advisory
- USN-1057-1 third-party-advisory vendor-advisory
- www.vmware.com third-party-advisory
- ADV-2011-0070 broken-link vdb-entry
- ADV-2011-0280 broken-link vdb-entry
- bugzilla.redhat.com issue-tracking patch third-party-advisory