CVE-2010-2524

The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's…

published September 8, 2010

CVSS
—
EPSS
0%
Percentile
35.6
In the wild
Unconfirmed
What it is

The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00423 · 35.6th percentile
Published
2010-09-08T19:00Z
EPSS history
Timeline
  • 08 SEP 19:00Z
    The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's…
    cvelistv5