InfoSec News

The Full Disclosure list sponsored by published an exploit regarding the CVE-2010-3081 vulnerability. It is triggered because of a stack pointer underflow regarding the function compat_alloc_user_space() inside arch/x86/include/asm/compat.h. This exploit is in the wild and it is highly recommended to implement the patch located at;a=commit;h=c41d68a513c71e35a14f66d71782d27a79a81ea6.

You might wonder why do I tell you to patch a vulnerability that has been published 12 days ago, right? Two days ago, the operations team of my companynoticed a strange behavior ona specific linux system. First thing I did was to review the latest vulnerabilities for the linux distribution installed on the machine and found CVE-2010-3081. Digginga little bit more let me foundan excellent tool made by Ksplice that told me the machine was exposed to the exploit.

Download the tool here: If you want the binary, download it here:
Read the Redhat Bugzilla info associated with CVE-2010-3081 here:
Read about the exploit here:
Read more about the vulnerability description here:
Can't patch right now? Use the following workaround: echo ':32bits:M:0:x7fELFx01::/bin/echo:' /proc/sys/fs/binfmt_misc/register
-- Manuel Humberto Santander Pelez ||| msantand at isc dot sans dot org (c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Internet Storm Center Infocon Status