CVE-2010-4243

MEDIUM
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an "OOM dodging issue," a related issue to CVE-2010-3858.

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3c77f845722158206a7209c45ccddc264d19319c

http://grsecurity.net/~spender/64bit_dos.c

http://linux.derkeiler.com/Mailing-Lists/Kernel/2010-11/msg13278.html

http://lkml.org/lkml/2010/8/27/429

http://lkml.org/lkml/2010/8/29/206

http://lkml.org/lkml/2010/8/30/138

http://lkml.org/lkml/2010/8/30/378

http://openwall.com/lists/oss-security/2010/11/22/15

http://openwall.com/lists/oss-security/2010/11/22/6

http://secunia.com/advisories/42884

http://secunia.com/advisories/46397

http://www.exploit-db.com/exploits/15619

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37

http://www.redhat.com/support/errata/RHSA-2011-0017.html

http://www.securityfocus.com/archive/1/520102/100/0/threaded

http://www.securityfocus.com/bid/45004

http://www.vmware.com/security/advisories/VMSA-2011-0012.html

https://bugzilla.redhat.com/show_bug.cgi?id=625688

https://exchange.xforce.ibmcloud.com/vulnerabilities/64700

Details

Source: MITRE

Published: 2011-01-22

Updated: 2020-08-12

Type: CWE-400

Risk Information

CVSS v2

Base Score: 4.9

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

Impact Score: 6.9

Exploitability Score: 3.9

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Tenable Plugins

View all (19 total)

IDNameProductFamilySeverity
89680VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)NessusMisc.
high
76634RHEL 6 : MRG (RHSA-2011:1253)NessusRed Hat Local Security Checks
high
75554openSUSE Security Update : kernel (openSUSE-SU-2011:0399-1)NessusSuSE Local Security Checks
high
68206Oracle Linux 6 : kernel (ELSA-2011-0283)NessusOracle Linux Local Security Checks
medium
65101Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1083-1)NessusUbuntu Local Security Checks
critical
60965Scientific Linux Security Update : kernel on SL6.x i386/x86_64NessusScientific Linux Local Security Checks
medium
56508VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service ConsoleNessusVMware ESX Local Security Checks
high
56192USN-1204-1 : linux-fsl-imx51 vulnerabilitiesNessusUbuntu Local Security Checks
high
56190USN-1202-1 : linux-ti-omap4 vulnerabilitiesNessusUbuntu Local Security Checks
high
55591Ubuntu 11.04 : linux vulnerabilities (USN-1167-1)NessusUbuntu Local Security Checks
medium
55589Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1159-1)NessusUbuntu Local Security Checks
high
55521Ubuntu 10.04 LTS : linux-mvl-dove vulnerabilities (USN-1162-1)NessusUbuntu Local Security Checks
high
55104Ubuntu 10.04 LTS : linux, linux-ec2 vulnerabilities (USN-1141-1)NessusUbuntu Local Security Checks
high
53740openSUSE Security Update : kernel (openSUSE-SU-2011:0346-1)NessusSuSE Local Security Checks
high
52597SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 4039 / 4042 / 4043)NessusSuSE Local Security Checks
high
52062RHEL 6 : kernel (RHSA-2011:0283)NessusRed Hat Local Security Checks
medium
51847Ubuntu 10.04 LTS / 10.10 : linux, linux-ec2 vulnerabilities (USN-1054-1)NessusUbuntu Local Security Checks
high
51818Debian DSA-2153-1 : linux-2.6 - privilege escalation/denial of service/information leakNessusDebian Local Security Checks
high
51522RHEL 5 : kernel (RHSA-2011:0017)NessusRed Hat Local Security Checks
medium