CVE-2010-4527: linux linux_kernel

Vulnerability summary

CVE-2010-4527 is a medium (CVSS 6.9) vulnerability in linux linux_kernel. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 42.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-01-2011
   PublishedVulnerability first disclosed.
2. 07-08-2024
   Last modifiedVulnerability information updated.

Description

The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.

• CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.