What’s Vulnerable › Vulnerabilities
CVE-2010-2803
- Severity: low (CVSS 1.9 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2010-09-08 · updated 2026-06-16
- Weakness: CWE-200
Description
The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.
Affected products
- Debian Linux: 5.0
- Linux kernel: before 2.6.27.53; from 2.6.32 before 2.6.32.21; from 2.6.34 before 2.6.34.6; from 2.6.35 before 2.6.35.4 — fixed in 2.6.27.53, 2.6.32.21, 2.6.34.6, 2.6.35.4
- Opensuse: 11.1, 11.3
- SUSE Linux Enterprise Server 15 SP1: 11-sp1
- SUSE Linux Enterprise High Availability Extension: 11-sp1
- SUSE Linux Enterprise Real Time: 11-sp1
- SUSE Linux Enterprise Server: 11-sp1
How to fix
Upgrade to a fixed version: Linux kernel 2.6.27.53, 2.6.32.21, 2.6.34.6, 2.6.35.4. Check the vendor advisory for mitigations.
References
- http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=1b2f1489633888d4a06028315dc19d65768a1c05
- http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html
- http://secunia.com/advisories/41512
- http://www.debian.org/security/2010/dsa-2094
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.53
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.21
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34.6
Get alerted when CVE-2010-2803 or the next vulnerability affects your stack