CVE-2010-3477

The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.

• CWE-399

• http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=0f04cfd098fb81fded74e78ea1a1b86cc6c6c31e
• http://secunia.com/advisories/42890Third Party Advisory
• http://secunia.com/advisories/46397Third Party Advisory
• http://www.debian.org/security/2010/dsa-2126Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4Broken Link, Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0779.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0839.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2011-0007.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/520102/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1024603Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1000-1Third Party Advisory
• http://www.vmware.com/security/advisories/VMSA-2011-0012.htmlThird Party Advisory
• http://git.kernel.org/?p=linux/kernel/git/davem/net-2.6.git%3Ba=commit%3Bh=0f04cfd098fb81fded74e78ea1a1b86cc6c6c31e
• http://secunia.com/advisories/42890Third Party Advisory
• http://secunia.com/advisories/46397Third Party Advisory
• http://www.debian.org/security/2010/dsa-2126Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.36-rc4Broken Link, Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0779.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0839.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2011-0007.htmlThird Party Advisory
• http://www.securityfocus.com/archive/1/520102/100/0/threadedThird Party Advisory, VDB Entry
• http://www.securitytracker.com/id?1024603Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-1000-1Third Party Advisory
• http://www.vmware.com/security/advisories/VMSA-2011-0012.htmlThird Party Advisory

Published

Sep 21, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-3471Session fixation vulnerability in the Workplace (aka WP) com…
• CVE-2010-3472Multiple cross-site scripting (XSS) vulnerabilities in the W…
• CVE-2010-3473Open redirect vulnerability in the Workplace (aka WP) compon…
• CVE-2010-3474IBM DB2 9.7 before FP3 does not perform the expected drops o…
• CVE-2010-3475IBM DB2 9.7 before FP3 does not properly enforce privilege r…
• CVE-2010-3476Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4…
• CVE-2010-3479SQL injection vulnerability in list.php in BoutikOne 1.0 all…
• CVE-2010-3480Directory traversal vulnerability in index.php in ApPHP PHP …
• CVE-2010-3481Multiple SQL injection vulnerabilities in login.php in ApPHP…
• CVE-2010-3482Multiple SQL injection vulnerabilities in cms_write.php in P…
• CVE-2010-3483cms_write.php in Primitive CMS 1.0.9 does not properly restr…
• CVE-2010-3484SQL injection vulnerability in common.php in LightNEasy 3.2.…