Skip to content
Fencer Intel
high 7.8

CVE-2010-3081 json

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not p…

published 16y ago modified 4mo ago also EUVD-2010-3083

cvss
7.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.5%
EPSS 3.5% chance of exploitation in 30 days, percentile 89%
public exploits
1
Exploit-DB

Summary

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

Patch / fix

  • kernel RHEL 6 2.6.32-71.7.1.el6
  • perf RHEL 6 2.6.32-71.7.1.el6
  • kernel-kdump RHEL 6 2.6.32-71.7.1.el6
  • kernel-firmware RHEL 6 2.6.32-71.7.1.el6
  • kernel-bootwrapper RHEL 6 2.6.32-71.7.1.el6
  • kernel-debuginfo-common-i686 RHEL 6 2.6.32-71.7.1.el6
  • kernel-debuginfo-common-ppc64 RHEL 6 2.6.32-71.7.1.el6
  • kernel-debuginfo-common-s390x RHEL 6 2.6.32-71.7.1.el6

red hat advisories RHSA-2010:0842RHSA-2010:0882RHSA-2010:0719RHSA-2010:0718RHSA-2010:0711RHSA-2010:0705

  • kernel-source openSUSE Tumbleweed 4.8.13-1.1

opensuse advisories openSUSE-SU-2024:10128-1

Is CVE-2010-3081 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2010-3081 updated cvss 7.2

kernel: 64-bit Compatibility Mode Stack Pointer Underflow

  • Red Hat MRG Realtime for RHEL 5 Server kernel-rt 2.6.24.7-169.el5rt, kernel-rt-trace 2.6.24.7-169.el5rt, kernel-rt-vanilla 2.6.24.7-169.el5rt, kernel-rt-debuginfo-common 2.6.24.7-169.el5rt
    fixed: vendor fix RHSA-2010:0758
  • Red Hat Enterprise Linux (v. 5 server) kernel 2.6.18-194.11.4.el5, kernel-PAE 2.6.18-194.11.4.el5, kernel-xen 2.6.18-194.11.4.el5, kernel-kdump 2.6.18-194.11.4.el5, kernel-debuginfo-common 2.6.18-194.11.4.el5
    fixed: vendor fix RHSA-2010:0704
  • Red Hat Enterprise Linux AS (v. 3 ELS) kernel 2.4.21-66.EL, kernel-smp 2.4.21-66.EL, kernel-BOOT 2.4.21-66.EL, kernel-source 2.4.21-66.EL, kernel-hugemem 2.4.21-66.EL, kernel-unsupported 2.4.21-66.EL, +2 more
    fixed: vendor fix RHSA-2010:0882
  • Red Hat Enterprise Linux AS EUS (v. 4.7) kernel 2.6.9-78.0.33.EL, kernel-smp 2.6.9-78.0.33.EL, kernel-xenU 2.6.9-78.0.33.EL, kernel-hugemem 2.6.9-78.0.33.EL, kernel-largesmp 2.6.9-78.0.33.EL
    fixed: vendor fix RHSA-2010:0719
  • Red Hat Enterprise Linux AS version 4 kernel 2.6.9-89.29.1.EL, kernel-smp 2.6.9-89.29.1.EL, kernel-xenU 2.6.9-89.29.1.EL, kernel-hugemem 2.6.9-89.29.1.EL, kernel-largesmp 2.6.9-89.29.1.EL
    fixed: vendor fix RHSA-2010:0718
  • Red Hat Enterprise Linux Desktop (v. 5 client) kernel 2.6.18-194.11.4.el5, kernel-PAE 2.6.18-194.11.4.el5, kernel-xen 2.6.18-194.11.4.el5, kernel-debuginfo-common 2.6.18-194.11.4.el5
    fixed: vendor fix RHSA-2010:0704
  • Red Hat Enterprise Linux Desktop (v. 6) perf 2.6.32-71.7.1.el6, kernel 2.6.32-71.7.1.el6, kernel-firmware 2.6.32-71.7.1.el6, kernel-debuginfo-common-i686 2.6.32-71.7.1.el6, kernel-debuginfo-common-x86_64 2.6.32-71.7.1.el6
    fixed: vendor fix RHSA-2010:0842
  • Red Hat Enterprise Linux Desktop version 4 kernel 2.6.9-89.29.1.EL, kernel-smp 2.6.9-89.29.1.EL, kernel-xenU 2.6.9-89.29.1.EL, kernel-hugemem 2.6.9-89.29.1.EL, kernel-largesmp 2.6.9-89.29.1.EL
    fixed: vendor fix RHSA-2010:0718
show 7 more
  • Red Hat Enterprise Linux ES (v. 3 ELS) kernel 2.4.21-66.EL, kernel-smp 2.4.21-66.EL, kernel-BOOT 2.4.21-66.EL, kernel-source 2.4.21-66.EL, kernel-hugemem 2.4.21-66.EL, kernel-unsupported 2.4.21-66.EL, +2 more
    fixed: vendor fix RHSA-2010:0882
  • Red Hat Enterprise Linux ES EUS (v. 4.7) kernel 2.6.9-78.0.33.EL, kernel-smp 2.6.9-78.0.33.EL, kernel-xenU 2.6.9-78.0.33.EL, kernel-hugemem 2.6.9-78.0.33.EL, kernel-largesmp 2.6.9-78.0.33.EL
    fixed: vendor fix RHSA-2010:0719
  • Red Hat Enterprise Linux ES version 4 kernel 2.6.9-89.29.1.EL, kernel-smp 2.6.9-89.29.1.EL, kernel-xenU 2.6.9-89.29.1.EL, kernel-hugemem 2.6.9-89.29.1.EL, kernel-largesmp 2.6.9-89.29.1.EL
    fixed: vendor fix RHSA-2010:0718
  • Red Hat Enterprise Linux EUS (v. 5.3 server) kernel 2.6.18-128.23.2.el5, kernel-PAE 2.6.18-128.23.2.el5, kernel-xen 2.6.18-128.23.2.el5, kernel-kdump 2.6.18-128.23.2.el5, kernel-debuginfo-common 2.6.18-128.23.2.el5
    fixed: vendor fix RHSA-2010:0711
  • Red Hat Enterprise Linux EUS (v. 5.4 server) kernel 2.6.18-164.25.2.el5, kernel-PAE 2.6.18-164.25.2.el5, kernel-xen 2.6.18-164.25.2.el5, kernel-kdump 2.6.18-164.25.2.el5, kernel-debuginfo-common 2.6.18-164.25.2.el5
    fixed: vendor fix RHSA-2010:0705
  • Red Hat Enterprise Linux HPC Node (v. 6) perf 2.6.32-71.7.1.el6, kernel 2.6.32-71.7.1.el6, kernel-firmware 2.6.32-71.7.1.el6, kernel-debuginfo-common-x86_64 2.6.32-71.7.1.el6 Red Hat Enterprise Linux Server (v. 6) perf 2.6.32-71.7.1.el6, kernel 2.6.32-71.7.1.el6, kernel-kdump 2.6.32-71.7.1.el6, kernel-firmware 2.6.32-71.7.1.el6, kernel-bootwrapper 2.6.32-71.7.1.el6, kernel-debuginfo-common-i686 2.6.32-71.7.1.el6, +3 more Red Hat Enterprise Linux Workstation (v. 6) perf 2.6.32-71.7.1.el6, kernel 2.6.32-71.7.1.el6, kernel-firmware 2.6.32-71.7.1.el6, kernel-debuginfo-common-i686 2.6.32-71.7.1.el6, kernel-debuginfo-common-x86_64 2.6.32-71.7.1.el6
    fixed: vendor fix RHSA-2010:0842
  • Red Hat Enterprise Linux WS version 4 kernel 2.6.9-89.29.1.EL, kernel-smp 2.6.9-89.29.1.EL, kernel-xenU 2.6.9-89.29.1.EL, kernel-hugemem 2.6.9-89.29.1.EL, kernel-largesmp 2.6.9-89.29.1.EL
    fixed: vendor fix RHSA-2010:0718

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-15024)
  2. Published

Exploit prediction

3.53% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-15024 Linux Kernel 2.6.27 < 2.6.36 (RedHat x86-64) - 'compat' Local Privilege Escalation local, 2010-09-16
  • access.redhat.com https://access.redhat.com/kb/docs/DOC-40265 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.