CVE-2010-1083 Common Vulnerabilities and Exposures

Upstream information

CVE-2010-1083 at MITRE

Description

The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
	National Vulnerability Database
Base Score	4.7
Vector	AV:L/AC:M/Au:N/C:C/I:N/A:N
Access Vector	Local
Access Complexity	Medium
Authentication	None
Confidentiality Impact	Complete
Integrity Impact	None
Availability Impact	None

SUSE Bugzilla entry: 605463 [RESOLVED / FIXED]

SUSE Security Advisories:

SUSE-SA:2010:019, published Tue, 30 Mar 2010 10:00:00 +0000
SUSE-SA:2010:023, published Thu, 06 May 2010 13:00:00 +0000
SUSE-SA:2010:036, published Wed, 01 Sep 2010 11:00:00 +0000

SUSE Timeline for this CVE

CVE page created: Fri Jun 28 04:04:52 2013
CVE page last modified: Fri Dec 8 16:38:29 2023