github - ghsa-fjxv-x673-382q

ghsa-fjxv-x673-382q

Vulnerability from github

Published

2022-05-13 01:24

Modified

2022-05-13 01:24

Details

The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2010-4074"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2010-11-29T16:00:00Z",
    "severity": "LOW"
  },
  "details": "The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.",
  "id": "GHSA-fjxv-x673-382q",
  "modified": "2022-05-13T01:24:12Z",
  "published": "2022-05-13T01:24:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4074"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=648659"
    },
    {
      "type": "WEB",
      "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098"
    },
    {
      "type": "WEB",
      "url": "http://lkml.org/lkml/2010/9/15/392"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/42890"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2010/dsa-2126"
    },
    {
      "type": "WEB",
      "url": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2010/09/25/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2010/10/06/6"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2010/10/07/1"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2010/10/25/3"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2010-0958.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2011-0007.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/45074"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2010-4074

Vulnerability from cvelistv5

Published

2010-11-29 15:00

Modified

2024-08-07 03:34

Severity ?

Summary

References

▼	URL	Tags
	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2010/09/25/2	mailing-list, x_refsource_MLIST
	http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2010/10/06/6	mailing-list, x_refsource_MLIST
	https://bugzilla.redhat.com/show_bug.cgi?id=648659	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2011-0007.html	vendor-advisory, x_refsource_REDHAT
	http://lkml.org/lkml/2010/9/15/392	mailing-list, x_refsource_MLIST
	http://www.redhat.com/support/errata/RHSA-2010-0958.html	vendor-advisory, x_refsource_REDHAT
	http://www.openwall.com/lists/oss-security/2010/10/07/1	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/45074	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/42890	third-party-advisory, x_refsource_SECUNIA
	http://www.openwall.com/lists/oss-security/2010/10/25/3	mailing-list, x_refsource_MLIST
	http://www.debian.org/security/2010/dsa-2126	vendor-advisory, x_refsource_DEBIAN

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:34:37.692Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098"
          },
          {
            "name": "[oss-security] 20100925 CVE request: multiple kernel stack memory disclosures",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/09/25/2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5"
          },
          {
            "name": "[oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/10/06/6"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=648659"
          },
          {
            "name": "RHSA-2011:0007",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2011-0007.html"
          },
          {
            "name": "[linux-kernel] 20100915 [PATCH] drivers/usb/serial/mos*: prevent reading uninitialized stack memory",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lkml.org/lkml/2010/9/15/392"
          },
          {
            "name": "RHSA-2010:0958",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0958.html"
          },
          {
            "name": "[oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/10/07/1"
          },
          {
            "name": "45074",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/45074"
          },
          {
            "name": "42890",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42890"
          },
          {
            "name": "[oss-security] 20101025 Re: CVE request: multiple kernel stack memory disclosures",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2010/10/25/3"
          },
          {
            "name": "DSA-2126",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2010/dsa-2126"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-09-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2010-12-10T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098"
        },
        {
          "name": "[oss-security] 20100925 CVE request: multiple kernel stack memory disclosures",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2010/09/25/2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5"
        },
        {
          "name": "[oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2010/10/06/6"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=648659"
        },
        {
          "name": "RHSA-2011:0007",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2011-0007.html"
        },
        {
          "name": "[linux-kernel] 20100915 [PATCH] drivers/usb/serial/mos*: prevent reading uninitialized stack memory",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lkml.org/lkml/2010/9/15/392"
        },
        {
          "name": "RHSA-2010:0958",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0958.html"
        },
        {
          "name": "[oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2010/10/07/1"
        },
        {
          "name": "45074",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/45074"
        },
        {
          "name": "42890",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42890"
        },
        {
          "name": "[oss-security] 20101025 Re: CVE request: multiple kernel stack memory disclosures",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2010/10/25/3"
        },
        {
          "name": "DSA-2126",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2010/dsa-2126"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-4074",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098",
              "refsource": "CONFIRM",
              "url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098"
            },
            {
              "name": "[oss-security] 20100925 CVE request: multiple kernel stack memory disclosures",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2010/09/25/2"
            },
            {
              "name": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5",
              "refsource": "CONFIRM",
              "url": "http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5"
            },
            {
              "name": "[oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2010/10/06/6"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=648659",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=648659"
            },
            {
              "name": "RHSA-2011:0007",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2011-0007.html"
            },
            {
              "name": "[linux-kernel] 20100915 [PATCH] drivers/usb/serial/mos*: prevent reading uninitialized stack memory",
              "refsource": "MLIST",
              "url": "http://lkml.org/lkml/2010/9/15/392"
            },
            {
              "name": "RHSA-2010:0958",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0958.html"
            },
            {
              "name": "[oss-security] 20101006 Re: CVE request: multiple kernel stack memory disclosures",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2010/10/07/1"
            },
            {
              "name": "45074",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/45074"
            },
            {
              "name": "42890",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/42890"
            },
            {
              "name": "[oss-security] 20101025 Re: CVE request: multiple kernel stack memory disclosures",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2010/10/25/3"
            },
            {
              "name": "DSA-2126",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2010/dsa-2126"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-4074",
    "datePublished": "2010-11-29T15:00:00",
    "dateReserved": "2010-10-25T00:00:00",
    "dateUpdated": "2024-08-07T03:34:37.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted