CVE-2010-4346 : The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected securi

The install_special_mapping function in mm/mmap.c in the Linux kernel before 2.6.37-rc6 does not make an expected security_file_mmap function call, which allows local users to bypass intended mmap_min_addr restrictions and possibly conduct NULL pointer dereference attacks via a crafted assembly-language application.

Published 2010-12-22 21:00:19

Updated 2023-02-13 04:28:36

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Memory Corruption

Threat overview for CVE-2010-4346

Top countries where our scanners detected CVE-2010-4346

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2010-4346 2,390

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2010-4346!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2010-4346

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 8 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2010-4346

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:N/I:P/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2010-4346

CWE-476 NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2010-4346

https://bugzilla.redhat.com/show_bug.cgi?id=662189

662189 – (CVE-2010-4346) CVE-2010-4346 kernel: install_special_mapping skips security_file_mmap check
Issue Tracking;Patch;Third Party Advisory
http://www.securityfocus.com/bid/45323

Linux Kernel 'install_special_mapping()' Local Security Bypass Vulnerability
Third Party Advisory;VDB Entry
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=462e635e5b73ba9a4c03913b77138cd57ce4b050
http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.37-rc6

404: File not found
Broken Link

CVEs referencing this url
http://www.securityfocus.com/archive/1/520102/100/0/threaded

SecurityFocus
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.vmware.com/security/advisories/VMSA-2011-0012.html

VMSA-2011-0012.3
Third Party Advisory

CVEs referencing this url
https://lkml.org/lkml/2010/12/9/222

LKML: Tavis Ormandy: [PATCH] install_special_mapping skips security_file_mmap check.
Mailing List;Patch;Third Party Advisory
http://openwall.com/lists/oss-security/2010/12/09/13

oss-security - Re: [taviso@...xchg8b.com: [PATCH] install_special_mapping skips security_file_mmap check.]
Mailing List;Patch;Third Party Advisory
http://openwall.com/lists/oss-security/2010/12/10/3

oss-security - Re: Subject: CVE request: kernel: install_special_mapping skips security_file_mmap check
Mailing List;Patch;Third Party Advisory
http://openwall.com/lists/oss-security/2010/12/10/2

oss-security - Subject: CVE request: kernel: install_special_mapping skips security_file_mmap check
Mailing List;Patch;Third Party Advisory
http://openwall.com/lists/oss-security/2010/12/09/12

oss-security - [taviso@...xchg8b.com: [PATCH] install_special_mapping skips security_file_mmap check.]
Mailing List;Patch;Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:029

mandriva.com
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2010-4346