CVE-2010-1083
- State
- Published
- Severity
- Not scored
- Published
- Apr 6, 2010
- Updated
- Aug 7, 2024
- Reserved
- Mar 23, 2010
Description
The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [linux-kernel] 20100330 [48/89] USB: usbfs: properly clean up the as structure on error pathsmailing-list
- oval:org.mitre.oval:def:10831vdb-entrysignature
- RHSA-2010:0723vendor-advisory
- [linux-kernel] 20100221 [80/93] USB: usbfs: properly clean up the as structure on error pathsmailing-list
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Consolemailing-list
- 46397third-party-advisory
- RHSA-2010:0394vendor-advisory
- [oss-security] 20100217 additional memory leak in USB userspace handlingmailing-list
- http://support.avaya.com/css/P8/documents/100090459
- [oss-security] 20100217 CVE request: kernel information leak via userspace USB interfacemailing-list
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- http://support.avaya.com/css/P8/documents/100113326
- SUSE-SA:2010:019vendor-advisory
- SUSE-SA:2010:023vendor-advisory
- [oss-security] 20100218 Re: CVE request: kernel information leak via userspace USB interfacemailing-list
- [oss-security] 20100219 Re: additional memory leak in USB userspace handlingmailing-list
- 39742third-party-advisory
- [oss-security] 20100219 Re: CVE request: kernel information leak via userspace USB interfacemailing-list
- DSA-2053vendor-advisory
- 39830third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.