CVE-2010-2943
- State
- Published
- Severity
- Not scored
- Published
- Sep 30, 2010
- Updated
- Aug 7, 2024
- Reserved
- Aug 4, 2010
Description
The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- [linux-xfs] 20100620 [PATCH 2/4] xfs: validate untrusted inode numbers during lookupmailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7124fe0a5b619d65b739477b3b55a20bf805b06d
- 42527vdb-entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7b6259e7a83647948fa33a736cc832310c8d85aa
- RHSA-2010:0723vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=624923
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Consolemailing-list
- [linux-xfs] 20100620 [PATCH 3/4] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTEDmailing-list
- 46397third-party-advisory
- [linux-xfs] 20100620 [PATCH 4/4] xfs: remove block number from inode lookup codemailing-list
- [oss-security] 20100818 CVE request - kernel: xfs: stale data exposuremailing-list
- [linux-xfs] 20100620 [PATCH 0/4, V2] xfs: validate inode numbers in file handles correctlymailing-list
- [xfs] 20100617 [PATCH] xfsqa: test open_by_handle() on unlinked and freed inode clusters V2mailing-list
- USN-1041-1vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35
- [xfs] 20100618 Re: [PATCH] xfsqa: test open_by_handle() on unlinked and freed inode clusters V2mailing-list
- ADV-2011-0280vdb-entry
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- 42758third-party-advisory
- http://support.avaya.com/css/P8/documents/100113326
- USN-1057-1vendor-advisory
- [oss-security] 20100819 Re: CVE request - kernel: xfs: stale data exposuremailing-list
- ADV-2011-0070vdb-entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1920779e67cbf5ea8afef317777c5bf2b8096188
- 43161third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.