CVE-2010-3858

CVE Details

Release Date:2010-11-30

Description


The setup_arg_pages function in fs/exec.c in the Linux kernel before 2.6.36, when CONFIG_STACK_GROWSDOWN is used, does not properly restrict the stack memory consumption of the (1) arguments and (2) environment for a 32-bit application on a 64-bit platform, which allows local users to cause a denial of service (system crash) via a crafted exec system call, a related issue to CVE-2010-2240. fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an OOM dodging issue, a related issue to CVE-2010-3858.

See more information about CVE-2010-3858 from MITRE CVE dictionary and NIST NVD


CVSS v2.0 metrics


NOTE: The following CVSS v2.0 metrics and score provided are preliminary and subject to review.

Base Score: 4.9 Base Metrics: AV:L/AC:L/Au:N/C:N/I:N/A:C
Access Vector: Local network Attack Complexity: Low
Authentication: None required Confidentiality Impact: None
Integrity Impact: None Availability Impact: Complete

Errata information


PlatformErrataRelease Date
Oracle Linux version 5 (kernel)ELSA-2011-00042011-01-04
Oracle Linux version 5 (ocfs2-2.6.18-194.32.1.0.1.el5)ELSA-2011-00042011-01-04
Oracle Linux version 5 (oracleasm-2.6.18-194.32.1.0.1.el5)ELSA-2011-00042011-01-04
Oracle Linux version 6 (kernel)ELSA-2011-08362011-06-02



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete