CVE-2010-3081 Privilege escalation in n/a

High 7.8 Published 24 Sep 2010 Updated 7 Aug 2024

Local attackers can gain privileges via a stack pointer underflow in the Linux kernel's 32-bit compatibility layer, requiring a kernel patch.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2010-3081?

CVE-2010-3081 is a high-severity vulnerability in Linux kernel, published on 24 Sep 2010. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

Weakness: CWE-119

Which versions are affected by CVE-2010-3081?

It affects 4 products.

Linux distribution packages (40)

`kernel` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-debuginfo` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-devel` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-doc` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-hugemem` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-hugemem-devel` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-largesmp` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-largesmp-devel` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-smp` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-smp-devel` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-xenU` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel-xenU-devel` Red Hat:enterprise_linux:4::as	All versions	`0:2.6.9-89.29.1.EL`
`kernel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-debuginfo` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-doc` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-hugemem` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-hugemem-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-largesmp` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-largesmp-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-smp` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-smp-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-xenU` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel-xenU-devel` Red Hat:enterprise_linux:4::desktop	All versions	`0:2.6.9-89.29.1.EL`
`kernel` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-debuginfo` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-devel` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-doc` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-hugemem` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-hugemem-devel` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-largesmp` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-largesmp-devel` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-smp` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-smp-devel` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-xenU` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel-xenU-devel` Red Hat:enterprise_linux:4::es	All versions	`0:2.6.9-89.29.1.EL`
`kernel` Red Hat:enterprise_linux:4::ws	All versions	`0:2.6.9-89.29.1.EL`
`kernel-debuginfo` Red Hat:enterprise_linux:4::ws	All versions	`0:2.6.9-89.29.1.EL`
`kernel-devel` Red Hat:enterprise_linux:4::ws	All versions	`0:2.6.9-89.29.1.EL`
`kernel-doc` Red Hat:enterprise_linux:4::ws	All versions	`0:2.6.9-89.29.1.EL`

Products include Linux kernel, Suse Suse Linux Enterprise Desktop, Suse Suse Linux Enterprise Server, Vmware Esx.

How do I fix CVE-2010-3081?

Apply the vendor's patch.

Is CVE-2010-3081 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-3081 exists.

Public exploit code: 1 Exploit-DB entry.

All Linux kernel vulnerabilities

Sources

Also known as GHSA-24vg-fhqp-9wrx, RHSA-2010:0704, RHSA-2010:0705, RHSA-2010:0711, RHSA-2010:0718, RHSA-2010:0719.