CVE-2010-2526 Auth bypass in n/a
Local attackers can bypass authentication in the LVM2 cluster daemon to cause denial of service or modify logical volumes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-2526?
CVE-2010-2526 is a medium-severity authentication bypass vulnerability in n/a, published on 4 Aug 2010. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.
Weakness: CWE-287
Which versions are affected by CVE-2010-2526?
It affects 1 product.
Linux distribution packages (4)
lvm2-cluster Red Hat:rhel_cluster_storage:5 | All versions | 0:2.02.56-7.el5_5.4 |
lvm2-cluster-debuginfo Red Hat:rhel_cluster_storage:5 | All versions | 0:2.02.56-7.el5_5.4 |
lvm2-cluster Red Hat:rhel_global_file_system:4 | All versions | 0:2.02.42-5.el4_8.2 |
lvm2-cluster-debuginfo Red Hat:rhel_global_file_system:4 | All versions | 0:2.02.42-5.el4_8.2 |
Products include Heinz Mauelshagen Lvm2.
How do I fix CVE-2010-2526?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2010-2526 being exploited?
There is no known exploitation of CVE-2010-2526 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2010-2526, DSA-2095-1, GHSA-2hvv-h4pw-wcm2, RHSA-2010:0567, RHSA-2010:0568.