NetSight
IP …
low2.1

CVE-2010-3477

The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.3…

Impact

The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 2.6.36
Version 2.6.36
DebianDebian Linux
Version 5.0
CanonicalUbuntu Linux
Versions 6.06, 8.04, 9.04, 9.10, 10.04, 10.10

Weakness classification

CWE-399

References