Description
The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | linux-2.6 | 2.6.26-22lenny1 | DSA-2053-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | kernel +12 | 2.6.18-194.17.1.el5 | RHSA-2010:0723 |
| RHEL 4 | kernel +10 | 2.6.9-89.0.25.EL | RHSA-2010:0394 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 1 | kernel-rt +10 | 2.6.24.7-161.el5rt | RHSA-2010:0631 |
Advisories 4
- RHSA-2010:0723 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0631 Red Hat Security Advisory: kernel-rt security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2010:0394 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2053-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- [linux-kernel] 20100330 [48/89] USB: usbfs: properly clean up the as structure on error paths mailing-list
- oval:org.mitre.oval:def:10831 vdb-entry signature
- RHSA-2010:0723 vendor-advisory
- [linux-kernel] 20100221 [80/93] USB: usbfs: properly clean up the as structure on error paths mailing-list
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list
- 46397 third-party-advisory
- RHSA-2010:0394 vendor-advisory
- [oss-security] 20100217 additional memory leak in USB userspace handling mailing-list
- http://support.avaya.com/css/P8/documents/100090459
- [oss-security] 20100217 CVE request: kernel information leak via userspace USB interface mailing-list
- http://www.vmware.com/security/advisories/VMSA-2011-0012.html
- http://support.avaya.com/css/P8/documents/100113326
- SUSE-SA:2010:019 vendor-advisory
- SUSE-SA:2010:023 vendor-advisory
- [oss-security] 20100218 Re: CVE request: kernel information leak via userspace USB interface mailing-list
- [oss-security] 20100219 Re: additional memory leak in USB userspace handling mailing-list
- 39742 third-party-advisory
- [oss-security] 20100219 Re: CVE request: kernel information leak via userspace USB interface mailing-list
- DSA-2053 vendor-advisory
- 39830 third-party-advisory