CVE-2010-2943

The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.

From the Ubuntu Security Team

Dave Chinner discovered that the XFS filesystem did not correctly order inode lookups when exported by NFS. A remote attacker could exploit this to read or write disk blocks that had changed file assignment or had become unlinked, leading to a loss of privacy.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	11.04 natty	Not affected
	10.10 maverick	Fixed 2.6.35-22.35
	10.04 LTS lucid	Fixed 2.6.32-27.49
	9.10 karmic	Fixed 2.6.31-22.70
	9.04 jaunty	Ignored end of life
	8.04 LTS hardy	Fixed 2.6.24-28.82
	6.06 LTS dapper	Not in release
linux-ec2	11.04 natty	Not in release
	10.10 maverick	Ignored end of life
	10.04 LTS lucid	Fixed 2.6.32-311.22
	9.10 karmic	Fixed 2.6.31-307.23
	9.04 jaunty	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-fsl-imx51	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Fixed 2.6.31-608.21
	9.10 karmic	Fixed 2.6.31-112.30
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-lts-backport-maverick	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Fixed 2.6.35-23.40~lucid1
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-mvl-dove	11.04 natty	Not in release
	10.10 maverick	Fixed 2.6.32-415.32
	10.04 LTS lucid	Fixed 2.6.32-213.29
	9.10 karmic	Ignored end of life
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-source-2.6.15	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Fixed 2.6.15-55.91
linux-ti-omap4	11.04 natty	Not affected
	10.10 maverick	Not affected
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7124fe0a5b619d65b739477b3b55a20bf805b06d Upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1920779e67cbf5ea8afef317777c5bf2b8096188 Upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7b6259e7a83647948fa33a736cc832310c8d85aa

Severity score breakdown

Parameter	Value
Base score	8.1 · High
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

Related Ubuntu Security Notices (USN)

USN-1072-1
Linux kernel vulnerabilities
25 February 2011

USN-1057-1
Linux kernel vulnerabilities
3 February 2011

USN-1074-1
Linux kernel vulnerabilities
25 February 2011

USN-1083-1
Linux kernel vulnerabilities
3 March 2011

USN-1041-1
Linux kernel vulnerabilities
10 January 2011

USN-1074-2
Linux kernel vulnerabilities
28 February 2011

USN-1093-1
Linux Kernel vulnerabilities (Marvell Dove)
25 March 2011