Bugzilla – Bug 535707
VUL-1: kernel: af_irda information leak (CVE-2009-3002)
Last modified: 2009-11-03 10:55:07 UTC
/* * cve-2009-3002.c * * Linux Kernel < 2.6.31-rc7 AF_IRDA getsockname 29-Byte Stack Disclosure * Jon Oberheide <jon@oberheide.org> * http://jon.oberheide.org * * Information: * * http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3002 * * The Linux kernel before 2.6.31-rc7 does not initialize certain data * structures within getname functions, which allows local users to read * the contents of some kernel memory locations by calling getsockname * on ... (2) an AF_IRDA socket, related to the irda_getname function in * net/irda/af_irda.c. * * Notes: * * Yet another stack disclosure...although this one is big and contiguous. */ I tried this on my desktop, it works. We need to fix this..
CVE-2009-3002: CVSS v2 Base Score: 4.9 (AV:L/AC:L/Au:N/C:C/I:N/A:N)
dup *** This bug has been marked as a duplicate of bug 534372 ***