The ip6_dst_lookup_tail function in net/ipv6/ip6_output.c in the Linux kernel before 2.6.27 does not properly handle certain circumstances involving an IPv6 TUN network interface and a large number of neighbors, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via unknown vectors.
Published 2010-03-24 13:34:34
Updated 2023-02-13 04:16:40
Source Red Hat, Inc.
View at NVD,   CVE.org
Vulnerability category: Memory CorruptionDenial of service

Products affected by CVE-2010-0437

Threat overview for CVE-2010-0437

Top countries where our scanners detected CVE-2010-0437
Top open port discovered on systems with this issue 52869
IPs affected by CVE-2010-0437 220,673
Threat actors abusing to this issue? Yes
Find out if you* are affected by CVE-2010-0437!
*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2010-0437

5.63%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2010-0437

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.8
HIGH AV:N/AC:L/Au:N/C:N/I:N/A:C
10.0
6.9
NIST

Vendor statements for CVE-2010-0437

  • Red Hat 2010-03-25
    Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/CVE-2010-0437. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3 and 4, as they do not include support for Optimistic Duplicate Address Detection (DAD) in IPv6. This was addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-9419.html. A future update in Red Hat Enterprise MRG may address this flaw.
Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!