Vulnerability Description
arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via read operations on the /dev/kvm device.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 2.6.36.2 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Suse | Suse Linux Enterprise Desktop | 11 |
| Suse | Suse Linux Enterprise High Availability Extension | 11 |
| Suse | Suse Linux Enterprise Server | 11 |
Related Weaknesses (CWE)
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=
- http://git.kernel.org/?p=virt/kvm/kvm.git%3Ba=commit%3Bh=831d9d02f9522e739825a51
- http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00004.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.htmlMailing ListThird Party Advisory
- http://openwall.com/lists/oss-security/2010/11/04/10Mailing ListPatchThird Party Advisory
- http://openwall.com/lists/oss-security/2010/11/05/4Mailing ListPatchThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2010-0998.htmlThird Party Advisory
- http://secunia.com/advisories/42932Third Party Advisory
- http://securitytracker.com/id?1024912Third Party AdvisoryVDB Entry
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36.2Release NotesVendor Advisory
- http://www.securityfocus.com/bid/44666PatchThird Party AdvisoryVDB Entry
- http://www.spinics.net/lists/kvm/msg44130.htmlPatchThird Party Advisory
- http://www.vupen.com/english/advisories/2010/3287Permissions Required
- http://www.vupen.com/english/advisories/2011/0124Permissions Required
- http://www.vupen.com/english/advisories/2011/0298Permissions Required
FAQ
What is CVE-2010-3881?
CVE-2010-3881 is a vulnerability with a CVSS score of 2.1 (LOW). arch/x86/kvm/x86.c in the Linux kernel before 2.6.36.2 does not initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via ...
How severe is CVE-2010-3881?
CVE-2010-3881 has been rated LOW with a CVSS base score of 2.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-3881?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Suse Suse Linux Enterprise Desktop, Suse Suse Linux Enterprise High Availability Extension.