The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.13-rc1 does not initialize certain padding fields in structures, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors, related to the (1) tc_fill_qdisc, (2) tcf_fill_node, (3) neightbl_fill_info, (4) neightbl_fill_param_info, (5) neigh_fill_info, (6) rtnetlink_fill_ifinfo, (7) rtnetlink_fill_iwinfo, (8) vif_delete, (9) ipmr_destroy_unres, (10) ipmr_cache_alloc_unres, (11) ipmr_cache_resolve, (12) inet6_fill_ifinfo, (13) tca_get_fill, (14) tca_action_flush, (15) tcf_add_notify, (16) tc_dump_action, (17) cbq_dump_police, (18) __nlmsg_put, (19) __rta_fill, (20) __rta_reserve, (21) inet6_fill_prefix, (22) rsvp_dump, and (23) cbq_dump_ovl functions.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-xenUUpgrade kernel-largesmpUpgrade kernel-smp-develUpgrade kernelUpgrade kernel-largesmp-develUpgrade kernel-docUpgrade kernel-xenU-develUpgrade kernel-develUpgrade kernel-smp | Dec 1, 2016 | Oct 19, 2009 |
| Suse | — | Upgrade kernel-default-manUpgrade ext4dev-kmp-defaultUpgrade kernel-ppc64-baseUpgrade ext4dev-kmp-xenUpgrade kernel-defaultUpgrade ext4dev-kmp-ppc64Upgrade kernel-vmi-baseUpgrade kernel-kdumpUpgrade kernel-ppc64Upgrade iscsitarget-kmp-defaultUpgrade ext4dev-kmp-paeUpgrade kernel-xen-baseUpgrade kernel-symsUpgrade kernel-xenUpgrade kernel-default-baseUpgrade ext4dev-kmp-vmiUpgrade kernel-paeUpgrade kernel-sourceUpgrade oracleasm-kmp-defaultUpgrade kernel-pae-baseUpgrade kernel-vmi | Feb 17, 2015 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub