CVE-2010-3081

High PUBLISHED

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly...

Linux · Linux Kernel

Not yet in CISA KEV

Exploited in the wild

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

7.8 High

At a Glance

The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.

linux

CVE Published: Sep 24, 2010
Exploitation Reported: Sep 24, 2010
CVSS: 7.8 High
EPSS: —

Low complexity No user interaction

Affected Versions

Vendor	Product	Version	Status
n/a	n/a	n/a	Affected

CVE References

MDVSA-2010:198 mandriva.com · Vendor Advisory http://www.mandriva.com/security/advisories?name=MDVSA-2010:198
SUSE-SA:2011:007 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000...
RHSA-2010:0842 redhat.com · Vendor Advisory http://www.redhat.com/support/errata/RHSA-2010-0842.html
MDVSA-2010:247 mandriva.com · Vendor Advisory http://www.mandriva.com/security/advisories?name=MDVSA-2010:247
RHSA-2010:0882 redhat.com · Vendor Advisory http://www.redhat.com/support/errata/RHSA-2010-0882.html

Show 23 more references

SUSE-SA:2010:050 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00003...
SUSE-SR:2010:017 lists.opensuse.org · Vendor Advisory http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006...
RHSA-2010:0758 redhat.com · Vendor Advisory http://www.redhat.com/support/errata/RHSA-2010-0758.html
MDVSA-2010:214 mandriva.com · Vendor Advisory http://www.mandriva.com/security/advisories?name=MDVSA-2010:214
42384 secunia.com · Third-Party Advisory http://secunia.com/advisories/42384
43315 secunia.com · Third-Party Advisory http://secunia.com/advisories/43315
ADV-2010-3083 vupen.com · VDB Entry http://www.vupen.com/english/advisories/2010/3083
ADV-2010-3117 vupen.com · VDB Entry http://www.vupen.com/english/advisories/2010/3117
ADV-2011-0298 vupen.com · VDB Entry http://www.vupen.com/english/advisories/2011/0298
20101130 VMSA-2010-0017 VMware ESX third party update for Service Console kerne securityfocus.com · Mailing List http://www.securityfocus.com/archive/1/514938/30/30/threaded
20100916 Workaround for Ac1db1tch3z exploit. archives.neohapsis.com · Mailing List http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0278.html
20100916 Ac1db1tch3z vs x86_64 Linux Kernel archives.neohapsis.com · Mailing List http://archives.neohapsis.com/archives/fulldisclosure/2010-09/0273.html
20110211 VMSA-2011-0003 Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX securityfocus.com · Mailing List http://www.securityfocus.com/archive/1/516397/100/0/threaded
[oss-security] 20100916 CVE-2010-3081 kernel: 64-bit Compatibility Mode Stack Pointer Underflow marc.info · Mailing List http://marc.info/?l=oss-security&m=128461522230211&w=2
vmware.com/security/advisories/VMSA-2010-0017.html vmware.com · CVE Record http://www.vmware.com/security/advisories/VMSA-2010-0017.html
isc.sans.edu/diary.html isc.sans.edu · CVE Record http://isc.sans.edu/diary.html?storyid=9574
sota.gen.nz/compat1 sota.gen.nz · CVE Record http://sota.gen.nz/compat1/
access.redhat.com/kb/docs/DOC-40265 access.redhat.com · CVE Record https://access.redhat.com/kb/docs/DOC-40265
kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36... kernel.org · CVE Record http://www.kernel.org/pub/linux/kernel/v2.6/snapshots/patch-2.6.36-rc...
blog.ksplice.com/2010/09/cve-2010-3081 blog.ksplice.com · CVE Record http://blog.ksplice.com/2010/09/cve-2010-3081/
vmware.com/security/advisories/VMSA-2011-0003.html vmware.com · CVE Record http://www.vmware.com/security/advisories/VMSA-2011-0003.html
git.kernel.org git.kernel.org · CVE Record http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=...
bugzilla.redhat.com/show_bug.cgi bugzilla.redhat.com · CVE Record https://bugzilla.redhat.com/show_bug.cgi?id=634457

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CVE First	2010-09-24 19:00 UTC

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2010-3081

{
  "cve_id": "CVE-2010-3081",
  "title": "The compat_alloc_user_space functions in include/asm/compat.h files in the Li...",
  "affected_vendor": "Linux",
  "affected_product": "Linux Kernel",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 7.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.