CVE-2010-0436 Race condition in n/a

Medium 6.9 Published 15 Apr 2010 Updated 7 Aug 2024

Local attackers can exploit a race condition in KDM to modify file permissions and gain elevated privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2010-0436?

CVE-2010-0436 is a medium-severity vulnerability in n/a, published on 15 Apr 2010. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Race condition in backend/ctrl.c in KDM in KDE Software Compilation (SC) 2.2.0 through 4.4.2 allows local users to change the permissions of arbitrary files, and consequently gain privileges, by blocking the removal of a certain directory that contains a control socket, related to improper interaction with ksm.

Weakness: CWE-362

Which versions are affected by CVE-2010-0436?

It affects 1 product.

Linux distribution packages (21)

`kdebase` Red Hat:enterprise_linux:4::as	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-devel` Red Hat:enterprise_linux:4::as	All versions	`6:3.3.1-13.el4_8.1`
`kdebase` Red Hat:enterprise_linux:4::desktop	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-devel` Red Hat:enterprise_linux:4::desktop	All versions	`6:3.3.1-13.el4_8.1`
`kdebase` Red Hat:enterprise_linux:4::es	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-devel` Red Hat:enterprise_linux:4::es	All versions	`6:3.3.1-13.el4_8.1`
`kdebase` Red Hat:enterprise_linux:4::ws	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`6:3.3.1-13.el4_8.1`
`kdebase-devel` Red Hat:enterprise_linux:4::ws	All versions	`6:3.3.1-13.el4_8.1`
`kdebase` Red Hat:enterprise_linux:5::client	All versions	`6:3.5.4-21.el5_5.1`
`kdebase-debuginfo` Red Hat:enterprise_linux:5::client	All versions	`6:3.5.4-21.el5_5.1`
`kdebase` Red Hat:enterprise_linux:5::client_workstation	All versions	`6:3.5.4-21.el5_5.1`
`kdebase-debuginfo` Red Hat:enterprise_linux:5::client_workstation	All versions	`6:3.5.4-21.el5_5.1`
`kdebase-devel` Red Hat:enterprise_linux:5::client_workstation	All versions	`6:3.5.4-21.el5_5.1`
`kdebase` Red Hat:enterprise_linux:5::server	All versions	`6:3.5.4-21.el5_5.1`
`kdebase-debuginfo` Red Hat:enterprise_linux:5::server	All versions	`6:3.5.4-21.el5_5.1`
`kdebase-devel` Red Hat:enterprise_linux:5::server	All versions	`6:3.5.4-21.el5_5.1`
`kdebase3` openSUSE:Tumbleweed	All versions	`4.11.22-6.8`

Products include Kde Kde Sc.

How do I fix CVE-2010-0436?

Apply the vendor's patch.

Is CVE-2010-0436 being exploited?

There is no known exploitation of CVE-2010-0436 in the wild and no public exploit code.

Sources

Also known as DSA-2037-1, GHSA-pq8f-75fc-mgwf, RHSA-2010:0348, openSUSE-SU-2024:10023-1.