CVE-2010-0453
En bref
- Source
- NVD
- EPSS
- EPSS 0.83 % · centile 58 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.
Faiblesses (CWE)
- CWE-20 — Validation d'entrée incorrecte
Références
- http://www.us-cert.gov/cas/techalerts/TA10-103B.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-21-143913-01-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/55991
- http://secunia.com/advisories/38452
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021799.1-1
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6959
- http://www.oracle.com/technetwork/topics/security/cpuapr2010-099504.html
- http://www.securityfocus.com/archive/1/509276/100/0/threaded
- http://www.securityfocus.com/bid/38016
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-275910-1
- http://osvdb.org/62046
- http://www.trapkit.de/advisories/TKADV2010-001.txt
- http://www.vupen.com/english/advisories/2010/0270
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.9 | AV:L/AC:L/Au:N/C:N/I:N/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2010-0484
- GCVE · GCVE-0-2010-0453
Avis du CERT-FR
- CERTA-2010-AVI-179 — Multiples vulnérabilités dans les produits Oracle · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:sun:opensolaris:snv_69:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_70:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_71:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_72:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_73:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_74:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_75:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_76:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_77:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_78:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_79:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_80:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_81:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_82:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_83:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_84:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_85:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_86:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_87:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_88:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_89:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_90:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_91:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_92:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_93:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_94:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_95:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_96:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_97:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_98:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_99:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_100:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_101:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_102:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_103:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_104:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_105:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_106:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_107:*:x86:*:*:*:*:*cpe:2.3:o:sun:opensolaris:snv_108:*:x86:*:*:*:*:*- +26 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |