What’s Vulnerable › Vulnerabilities

CVE-2010-1437

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-05-07 · updated 2026-06-16
• Weakness: CWE-362

Description

Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

Affected products

• Debian Linux: 5.0
• Linux kernel: before 2.6.34; 2.6.34-rc1, 2.6.34-rc2, 2.6.34-rc3, 2.6.34-rc4, 2.6.34-rc5 — fixed in 2.6.34
• Opensuse: 11.1
• SUSE Linux Enterprise Server 15 SP1: 11
• SUSE Linux Enterprise High Availability Extension: 11
• SUSE Linux Enterprise Server: 11

How to fix

Upgrade to a fixed version: Linux kernel 2.6.34. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2010-07/msg00006.html
• http://marc.info/?l=linux-kernel&m=127192182917857&w=2
• http://marc.info/?l=linux-kernel&m=127274294622730&w=2
• http://marc.info/?l=linux-kernel&m=127292492727029&w=2
• http://secunia.com/advisories/39830
• http://secunia.com/advisories/40218
• http://secunia.com/advisories/40645
• http://secunia.com/advisories/43315
• http://www.debian.org/security/2010/dsa-2053
• http://www.openwall.com/lists/oss-security/2010/04/27/2
• http://www.openwall.com/lists/oss-security/2010/04/28/2
• http://www.redhat.com/support/errata/RHSA-2010-0474.html

Get alerted when CVE-2010-1437 or the next vulnerability affects your stack