CVE-2010-2240

Publication date 17 August 2010

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The do_anonymous_page function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the heap, which allows context-dependent attackers to execute arbitrary code by writing to the bottom page of a shared memory segment, as demonstrated by a memory-exhaustion attack against the X.Org X server.

From the Ubuntu Security Team

Gael Delalleu, Rafal Wojtczuk, and Brad Spengler discovered that the memory manager did not properly handle when applications grow stacks into adjacent memory regions. A local attacker could exploit this to gain control of certain applications, potentially leading to privilege escalation, as demonstrated in attacks against the X server.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
linux 10.10 maverick
Fixed 2.6.35-16.22
10.04 LTS lucid
Fixed 2.6.32-24.41
9.10 karmic
Fixed 2.6.31-22.63
9.04 jaunty
Fixed 2.6.28-19.64
8.04 LTS hardy
Fixed 2.6.24-28.75
6.06 LTS dapper Not in release
linux-ec2 10.10 maverick Ignored end of life
10.04 LTS lucid
Fixed 2.6.32-308.15
9.10 karmic
Fixed 2.6.31-307.17
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-fsl-imx51 10.10 maverick Not in release
10.04 LTS lucid
Fixed 2.6.31-608.19
9.10 karmic
Fixed 2.6.31-112.30
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-mvl-dove 10.10 maverick
Not affected
10.04 LTS lucid
Fixed 2.6.32-208.24
9.10 karmic
Fixed 2.6.31-214.30
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-source-2.6.15 10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
9.04 jaunty Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper
Fixed 2.6.15-55.87

Notes

smb

There seem to be three follow-up patches upstream (one of them is not CCed to stable, but should be (gets fixed up actually)).

jdstrand

caused regression in Xen on hardy

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
linux
linux-source-2.6.15

References

Related Ubuntu Security Notices (USN)

    • USN-974-1
    • Linux kernel vulnerabilities
    • 19 August 2010
    • USN-1074-1
    • Linux kernel vulnerabilities
    • 25 February 2011

Other references