CVE-2010-4074

The USB subsystem in the Linux kernel before 2.6.36-rc5 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel stack memory via vectors related to TIOCGICOUNT ioctl calls, and the (1) mos7720_ioctl function in drivers/usb/serial/mos7720.c and (2) mos7840_ioctl function in drivers/usb/serial/mos7840.c.

• CWE-200

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098
• http://lkml.org/lkml/2010/9/15/392Mailing List, Patch, Third Party Advisory
• http://secunia.com/advisories/42890Third Party Advisory
• http://www.debian.org/security/2010/dsa-2126Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5Broken Link
• http://www.openwall.com/lists/oss-security/2010/09/25/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/10/06/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/10/07/1Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/10/25/3Mailing List, Patch, Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0958.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2011-0007.htmlThird Party Advisory
• http://www.securityfocus.com/bid/45074Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=648659Issue Tracking, Patch, Third Party Advisory
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a0846f1868b11cd827bdfeaf4527d8b1b1c0b098
• http://lkml.org/lkml/2010/9/15/392Mailing List, Patch, Third Party Advisory
• http://secunia.com/advisories/42890Third Party Advisory
• http://www.debian.org/security/2010/dsa-2126Third Party Advisory
• http://www.kernel.org/pub/linux/kernel/v2.6/testing/v2.6.36/ChangeLog-2.6.36-rc5Broken Link
• http://www.openwall.com/lists/oss-security/2010/09/25/2Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/10/06/6Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/10/07/1Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2010/10/25/3Mailing List, Patch, Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0958.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2011-0007.htmlThird Party Advisory
• http://www.securityfocus.com/bid/45074Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=648659Issue Tracking, Patch, Third Party Advisory

Published

Nov 29, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-4068Unspecified vulnerability in the Extension Manager in TYPO3 …
• CVE-2010-4069Stack-based buffer overflow in IBM Informix Dynamic Server (…
• CVE-2010-4070Integer overflow in librpc.dll in portmap.exe (aka the ISM P…
• CVE-2010-4071Cross-site scripting (XSS) vulnerability in AgentTicketZoom …
• CVE-2010-4072The copy_shmid_to_user function in ipc/shm.c in the Linux ke…
• CVE-2010-4073The ipc subsystem in the Linux kernel before 2.6.37-rc1 does…
• CVE-2010-4075The uart_get_count function in drivers/serial/serial_core.c …
• CVE-2010-4076The rs_ioctl function in drivers/char/amiserial.c in the Lin…
• CVE-2010-4077The ntty_ioctl_tiocgicount function in drivers/char/nozomi.c…
• CVE-2010-4078The sisfb_ioctl function in drivers/video/sis/sis_main.c in …
• CVE-2010-4079The ivtvfb_ioctl function in drivers/media/video/ivtv/ivtvfb…
• CVE-2010-4080The snd_hdsp_hwdep_ioctl function in sound/pci/rme9652/hdsp.…