CVE-2010-2522 Auth bypass in n/a
Local attackers can spoof netlink messages in the UMIP mipv6 daemon due to missing origin verification, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-2522?
CVE-2010-2522 is a low-severity authentication bypass vulnerability in n/a, published on 13 Jul 2010. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The mipv6 daemon in UMIP 0.4 does not verify that netlink messages originated in the kernel, which allows local users to spoof netlink socket communication via a crafted unicast message.
Weakness: CWE-264
Which versions are affected by CVE-2010-2522?
It affects 1 product.
Products include Linux-Ipv6 Umip.
How do I fix CVE-2010-2522?
Apply the vendor's patch.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2010-2522 being exploited?
There is no known exploitation of CVE-2010-2522 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-f7rp-3ppx-hhqw.