Strix
26.1K

CVE-2010-2943

HIGHCVSS 8.1/10EPSS 17.01%

Last modified

CVE-2010-2943 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.. EPSS estimates a 17.01% chance of exploitation in the next 30 days.

Description

The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.

Metrics

CVSS 3.1
8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Probability
17.01%

96.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
LinuxLinux Kernel< 2.6.35
CanonicalUbuntu Linux6.06
CanonicalUbuntu Linux9.10
CanonicalUbuntu Linux10.04
CanonicalUbuntu Linux10.10
VmwareEsx4.0
VmwareEsx4.1
AvayaAura Communication Manager5.2
AvayaAura Presence Services6.0
AvayaAura Presence Services6.1
AvayaAura Presence Services6.1.1
AvayaAura Session Manager1.1
AvayaAura Session Manager5.2
AvayaAura Session Manager6.0
AvayaAura System Manager5.2
AvayaAura System Manager6.0
AvayaAura System Manager6.1
AvayaAura System Manager6.1.1
AvayaAura System Platform1.1
AvayaAura System Platform6.0
AvayaAura Voice Portal5.0
AvayaAura Voice Portal5.1
AvayaIq5.0
AvayaIq5.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2010-2943?
The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
How severe is CVE-2010-2943?
CVE-2010-2943 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 17.01% probability of exploitation in the next 30 days.
How do I fix CVE-2010-2943?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2010-2943?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST