Bug 628770 (CVE-2010-2954) - CVE-2010-2954 kernel: NULL deref and panic in irda
Summary: CVE-2010-2954 kernel: NULL deref and panic in irda
Alias: CVE-2010-2954
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 628771
TreeView+ depends on / blocked
Reported: 2010-08-31 02:02 UTC by Eugene Teo (Security Response)
Modified: 2023-05-11 15:59 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2010-12-21 17:08:34 UTC

Attachments (Terms of Use)

Description Eugene Teo (Security Response) 2010-08-31 02:02:34 UTC
Description of problem:
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f7f06dca>] hashbin_delete+0x14/0xad [irda]
*pdpt = 0000000000a57001 *pde = 0000000000000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/virtual/dmi/id/sys_vendor
Modules linked in: irda crc_ccitt fuse ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 vmblock vsock vmmemctl vmhgfs uinput pcnet32 ppdev vmxnet microcode parport_pc parport mii vmci i2c_piix4 i2c_core mptspi mptscsih mptbase scsi_transport_spi [last unloaded: scsi_wait_scan]

Pid: 2403, comm: a.out Not tainted #1 440BX Desktop Reference Platform/VMware Virtual Platform
EIP: 0060:[<f7f06dca>] EFLAGS: 00010282 CPU: 0
EIP is at hashbin_delete+0x14/0xad [irda]
EAX: 00000000 EBX: 00000000 ECX: f2f97f4c EDX: f7f084aa
ESI: df1b8800 EDI: f7f084aa EBP: eb19bd78 ESP: eb19bd64
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process a.out (pid: 2403, ti=eb19a000 task=f2ed9980 task.ti=eb19a000)
 00000000 00000202 eb0df2c0 df1b8800 df1a6770 eb19bd84 f7f085f5 eb0df2c0
<0> eb19bd90 f7f0861f eb20c400 eb19bda4 f7f0a958 df1b8800 f7f0ebe4 df1a6770
<0> eb19bdb4 c06ef16e f2e21100 00000008 eb19bdbc c06ef1cf eb19bde0 c04d183a
Call Trace:
 [<f7f085f5>] ? __irias_delete_object+0x1b/0x2c [irda]
 [<f7f0861f>] ? irias_delete_object+0x19/0x1e [irda]
 [<f7f0a958>] ? irda_release+0x65/0x127 [irda]
 [<c06ef16e>] ? sock_release+0x14/0x59
 [<c06ef1cf>] ? sock_close+0x1c/0x20
 [<c04d183a>] ? __fput+0xea/0x181
 [<c04d18e4>] ? fput+0x13/0x15
 [<c04cef5f>] ? filp_close+0x51/0x5b
 [<c043f260>] ? put_files_struct+0x5f/0xb3
 [<c043f2e8>] ? exit_files+0x34/0x38
 [<c0440a1b>] ? do_exit+0x200/0x615
 [<c044c4c0>] ? dequeue_signal+0xb1/0x120
 [<c0440e9b>] ? do_group_exit+0x6b/0x94
 [<c044c89d>] ? get_signal_to_deliver+0x36e/0x389
 [<c0407cd4>] ? do_signal+0x5a/0x6f4
 [<c078359d>] ? apic_timer_interrupt+0x31/0x38
 [<c0455f57>] ? hrtimer_nanosleep+0x94/0xdc
 [<c04d7376>] ? path_put+0x15/0x18
 [<c047c6a6>] ? audit_syscall_exit+0xfa/0x10f
 [<c040838d>] ? do_notify_resume+0x1f/0x79
 [<c07831e4>] ? work_notifysig+0x13/0x1b
Code: 04 01 74 0b 8b 55 f0 8d 43 0c e8 b8 bf 87 c8 83 c4 0c 5b 5e 5f 5d c3 55 89 e5 57 89 d7 56 53 89 c3 83 ec 08 c7 45 ec 00 00 00 00 <f6> 40 04 01 74 0b 8d 40 0c e8 40 bf 87 c8 89 45 ec 89 de c7 45
EIP: [<f7f06dca>] hashbin_delete+0x14/0xad [irda] SS:ESP 0068:eb19bd64
CR2: 0000000000000004
---[ end trace 8c5fb89ec896b3a8 ]---
Fixing recursive fault but reboot is needed!


Red Hat would like to thank Tavis Ormandy for reporting this issue.

Comment 2 Eugene Teo (Security Response) 2010-08-31 02:18:02 UTC

This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3, 4, 5, and Red Hat Enterprise MRG as it did not include
support for the IrDA protocol.

Comment 3 Eugene Teo (Security Response) 2010-08-31 08:20:08 UTC
[PATCH] irda: Correctly clean up self->ias_obj on irda_bind() failure.

Comment 6 Eugene Teo (Security Response) 2010-09-08 05:57:00 UTC
Upstream commit:

Comment 7 Vincent Danen 2010-12-21 17:08:34 UTC
This was corrected in Fedora via:


Note You need to log in before you can comment on or make changes to this bug.