Vulnerability Details : CVE-2010-2526
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.
Vulnerability category: BypassGain privilegeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2010-2526
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-2526
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.6
|
MEDIUM | AV:L/AC:L/Au:N/C:P/I:P/A:P |
3.9
|
6.4
|
NIST |
CWE ids for CVE-2010-2526
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-2526
-
http://www.vupen.com/english/advisories/2010/1944
Webmail | OVH- OVHVendor Advisory
-
https://www.redhat.com/archives/linux-lvm/2010-July/msg00083.html
[linux-lvm] lvm2-cluster (clvmd) security fix (Moderate)
-
http://securitytracker.com/id?1024258
LVM2 Missing Authentication in Cluster Local Volume Manager Lets Local Users Manage Volumes in the Cluster - SecurityTracker
-
https://rhn.redhat.com/errata/RHSA-2010-0568.html
RHSA-2010:0568 - Security Advisory - Red Hat Customer Portal
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/60809
LVM2 socket priviliege escalation CVE-2010-2526 Vulnerability Report
-
https://rhn.redhat.com/errata/RHSA-2010-0567.html
RHSA-2010:0567 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2010:017
-
http://www.ubuntu.com/usn/USN-1001-1
USN-1001-1: LVM2 vulnerability | Ubuntu security notices
-
https://bugzilla.redhat.com/show_bug.cgi?id=614248
614248 – (CVE-2010-2526) CVE-2010-2526 lvm2-cluster: insecurity when communicating between lvm2 and clvmdExploit
Products affected by CVE-2010-2526
- cpe:2.3:a:heinz_mauelshagen:lvm2:*:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.67:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.66:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.58:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.57:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.50:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.70:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.62:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.61:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.54:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.53:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.69:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.68:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.60:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.59:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.52:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.51:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.65:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.64:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.63:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.56:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite
- cpe:2.3:a:heinz_mauelshagen:lvm2:2.02.55:*:*:*:*:*:*:*When used together with: Redhat » Cluster Suite