{
  "threat_severity" : "Important",
  "public_date" : "2010-10-22T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: tipc: heap overflow in tipc_msg_build()",
    "id" : "645867",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=645867"
  },
  "cvss" : {
    "cvss_base_score" : "6.9",
    "cvss_scoring_vector" : "AV:L/AC:M/Au:N/C:C/I:C/A:C",
    "status" : "verified"
  },
  "details" : [ "Multiple integer signedness errors in the TIPC implementation in the Linux kernel before 2.6.36.2 allow local users to gain privileges via a crafted sendmsg call that triggers a heap-based buffer overflow, related to the tipc_msg_build function in net/tipc/msg.c and the verify_iovec function in net/core/iovec.c." ],
  "statement" : "Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/CVE-2010-3859.\nThis issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 6 and Red Hat Enterprise MRG as they did not include support for Transparent Inter-Process Communication Protocol (TIPC). A future kernel update in Red Hat Enterprise Linux 5 may address this flaw. As a\npreventive measure, we plan to include the fixes in a future kernel update in Red Hat Enterprise Linux 4.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 4",
    "release_date" : "2011-01-18T00:00:00Z",
    "advisory" : "RHSA-2011:0162",
    "cpe" : "cpe:/o:redhat:enterprise_linux:4",
    "package" : "kernel-0:2.6.9-89.35.1.EL"
  }, {
    "product_name" : "Red Hat Enterprise Linux 5",
    "release_date" : "2011-01-04T00:00:00Z",
    "advisory" : "RHSA-2011:0004",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5",
    "package" : "kernel-0:2.6.18-194.32.1.el5"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2010-3859\nhttps://nvd.nist.gov/vuln/detail/CVE-2010-3859" ],
  "name" : "CVE-2010-3859",
  "mitigation" : {
    "value" : "For users that do not run applications that use TIPC, you can prevent the TIPC\nmodule from being loaded by adding the following entry to the end of the\n/etc/modprobe.d/blacklist file:\nblacklist tipc\nThis way, the TIPC module cannot be loaded accidentally, which may occur if an\napplication that requires TIPC is started. A reboot is not necessary for this\nchange to take effect but do make sure the module is not loaded in the first\nplace. You can verify that by running:\nlsmod | grep tipc\nYou may also consider removing the CAP_SYS_MODULE capability from the current\nglobal capability set to prevent kernel modules from being loaded or unloaded.\nThe CAP_SYS_MODULE has a capability number of 16 (see linux/capability.h). The\ndefault value has all the bits set. To remove this capability, you have to\nclear the 16th bit of the default 32-bit value, e.g. 0xffffff ^ (1 << 16):\necho 0xFFFEFFFF > /proc/sys/kernel/cap-bound",
    "lang" : "en:us"
  },
  "csaw" : false
}