CVE-2010-1636

The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the btrfs functionality in the Linux kernel 2.6.29 through 2.6.32, and possibly other versions, does not ensure that a cloned file descriptor has been opened for reading, which allows local users to read sensitive information from a write-only file descriptor.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	10.04 LTS lucid	Fixed 2.6.32-23.37
	9.10 karmic	Fixed 2.6.31-22.61
	9.04 jaunty	Not affected
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not in release
linux-source-2.6.15	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not affected

Notes

smb

No btrfs before Karmic

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=5dc6416414fb3ec6e2825fd4d20c8bf1d7fe0395 Karmic: http://chinstrap.ubuntu.com/~smb/CVEs/CVE-2010-1636/patches/karmic/linux/0001-Btrfs-check-for-read-permission-on-src-file-in-the-clo.txt

Status

Notes

smb

Patch details

References

Related Ubuntu Security Notices (USN)

Other references