CVE-2010-4258

The do_exit function in kernel/exit.c in the Linux kernel before 2.6.36.2 does not properly handle a KERNEL_DS get_fs value, which allows local users to bypass intended access_ok restrictions, overwrite arbitrary kernel memory locations, and gain privileges by leveraging a (1) BUG, (2) NULL pointer dereference, or (3) page fault, as demonstrated by vectors involving the clear_child_tid feature and the splice system call.

CVSS v2.0

6.2 MEDIUMAV:L/AC:H/Au:N/C:C/I:C/A:C

EPSS

2.66% chance of exploitation in the next 30 days, 85th percentile

Published

2010-12-30

Updated

2024-08-07

Proof-of-concept exploits (1)

• http://archives.neohapsis.com/archives/fulldisclosure/2010-12/0086.html

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/15704

Exploit collections (1)

• helloexp/0day/tree/master/98-Linux%E6%8F%90%E6%9D%83/2010/CVE-2010-4258

References

• CVE Record
• NVD entry

Related

• CVE-2010-4257
• CVE-2010-4259
• CVE-2010-4254
• CVE-2010-4262
• CVE-2010-4250
• CVE-2010-4268