Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 283825 (CVE-2009-3002) - Kernel: getsockname() Multiple Information Disclosure vulnerabilities (CVE-2009-3002)
Summary: Kernel: getsockname() Multiple Information Disclosure vulnerabilities (CVE-20...
Status: RESOLVED FIXED
Alias: CVE-2009-3002
Product: Gentoo Security
Classification: Unclassified
Component: Kernel (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: http://git.kernel.org/?p=linux/kernel...
Whiteboard: [linux <2.6.31]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-09-06 09:48 UTC by Alex Legler (RETIRED)
Modified: 2013-09-15 18:42 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alex Legler (RETIRED) archtester gentoo-dev Security 2009-09-06 09:48:34 UTC 
CVE-2009-3002 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3002):
  The Linux kernel before 2.6.31-rc7 does not initialize certain data
  structures within getname functions, which allows local users to read
  the contents of some kernel memory locations by calling getsockname
  on (1) an AF_APPLETALK socket, related to the atalk_getname function
  in net/appletalk/ddp.c; (2) an AF_IRDA socket, related to the
  irda_getname function in net/irda/af_irda.c; (3) an AF_ECONET socket,
  related to the econet_getname function in net/econet/af_econet.c; (4)
  an AF_NETROM socket, related to the nr_getname function in
  net/netrom/af_netrom.c; (5) an AF_ROSE socket, related to the
  rose_getname function in net/rose/af_rose.c; or (6) a raw CAN socket,
  related to the raw_getname function in net/can/raw.c.