Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 283825 (CVE-2009-3002) - Kernel: getsockname() Multiple Information Disclosure vulnerabilities (CVE-2009-3002)
Summary: Kernel: getsockname() Multiple Information Disclosure vulnerabilities (CVE-20...
Status: RESOLVED FIXED
Alias: CVE-2009-3002
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal
Assignee: Gentoo Security
URL: http://git.kernel.org/?p=linux/kernel...
Whiteboard: [linux <2.6.31]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-06 09:48 UTC by Alex Legler (RETIRED)
Modified: 2013-09-15 18:42 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Legler (RETIRED) archtester gentoo-dev Security 2009-09-06 09:48:34 UTC
CVE-2009-3002 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3002):
  The Linux kernel before 2.6.31-rc7 does not initialize certain data
  structures within getname functions, which allows local users to read
  the contents of some kernel memory locations by calling getsockname
  on (1) an AF_APPLETALK socket, related to the atalk_getname function
  in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the
  irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket,
  related to the econet_getname function in net/econet/af_econet.c; (4)
  an AF_NETROM socket, related to the nr_getname function in
  net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the
  rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket,
  related to the raw_getname function in net/can/raw.c.