Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceCVE-2010-4655

CVE-2010-4655

MEDIUM5.5

net/core/ethtool

Published Jul 18, 2011

Modified 1 years ago

Details

net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b00916b189d13a615ff05c9242201135992fcda3

http://openwall.com/lists/oss-security/2011/01/24/9

http://openwall.com/lists/oss-security/2011/01/25/3

http://openwall.com/lists/oss-security/2011/01/25/4

http://openwall.com/lists/oss-security/2011/01/25/5

http://openwall.com/lists/oss-security/2011/01/28/1

http://secunia.com/advisories/46397

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36

http://www.securityfocus.com/archive/1/520102/100/0/threaded

http://www.securityfocus.com/bid/45972

http://www.ubuntu.com/usn/USN-1146-1

http://www.vmware.com/security/advisories/VMSA-2011-0012.html

https://bugzilla.redhat.com/show_bug.cgi?id=672428

https://lkml.org/lkml/2010/10/7/297

https://www.cve.org/CVERecord?id=CVE-2010-4655

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

5.5/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Ecosystems

Timeline

PublishedJul 18, 2011

ModifiedAug 7, 2024

CVE-2010-4655 | Mondoo Vulnerability Intelligence