National Cyber Awareness System

Vulnerability Summary for CVE-2010-2526

Overview

The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: MLIST

Name: [linux-lvm] 20100728 lvm2-cluster (clvmd) security fix (Moderate)

Hyperlink:https://www.redhat.com/archives/linux-lvm/2010-July/msg00083.html

External Source: REDHAT

Name: RHSA-2010:0568

Hyperlink:https://rhn.redhat.com/errata/RHSA-2010-0568.html

External Source: REDHAT

Name: RHSA-2010:0567

Hyperlink:https://rhn.redhat.com/errata/RHSA-2010-0567.html

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=614248

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=614248

External Source: XF

Name: lvm2-socket-privilege-escalation(60809)

Hyperlink:http://xforce.iss.net/xforce/xfdb/60809

External Source: VUPEN

Name: ADV-2010-1944

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2010/1944

External Source: UBUNTU

Name: USN-1001-1

Hyperlink:http://www.ubuntu.com/usn/USN-1001-1

External Source: OSVDB

Name: 66753

Hyperlink:http://www.osvdb.org/66753

External Source: SECTRACK

Name: 1024258

Hyperlink:http://securitytracker.com/id?1024258

External Source: SECUNIA

Name: 40759

Type: Advisory

Hyperlink:http://secunia.com/advisories/40759

External Source: SUSE

Name: SUSE-SR:2010:017

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html