Description
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | linux-2.6 | 2.6.32-34squeeze1 | DSA-2240-1 |
| Debian 5.0 | linux-2.6 | 2.6.26-26lenny3 | DSA-2264-1 |
Advisories 2
- DSA-2240-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2264-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- [netdev] 20110317 [PATCH] econet: 4 byte infoleak to the network mailing-list
- [oss-security] 20110318 CVE request: kernel: netfilter & econet infoleaks mailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=67c5c6cb8129c595f21e88254a3fc6b3b841ae8e
- 8279 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39
- https://bugzilla.redhat.com/show_bug.cgi?id=591815#c14
- [oss-security] 20110321 Re: CVE request: kernel: netfilter & econet infoleaks mailing-list
- [oss-security] 20110321 Re: CVE request: kernel: netfilter & econet infoleaks mailing-list