Read the docs
TI-2010-00695 Aliases CVE-2010-0727GHSA-xfgm-rcpf-gf3q

The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the…

Priority LOW 23CWE-399Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.

Why it matters now

EPSS 0.0056 46th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Red Hat: 6 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*up to 2.6.33.1VulnerableLinux
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*5.0VulnerableDebian
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions up to 2.6.33.1 Vulnerable ·Linux
  • cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Debian
  • cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat

Remediation

Red Hat 6 advisories

  • RHSA-2010:0521 Released 2010-07-08 · Red Hat rating Moderate
    gfs-kmod security update
    • RHEL Cluster-Storage (v. 5.4.Z server) gfs-kmod-0.1.34-2.el5_4.3, kmod-gfs-0.1.34-2.el5_4.3, kmod-gfs-0.1.34-2.el5_4.3.ia64 +3
  • RHSA-2010:0380 Released 2010-04-27 · Red Hat rating Important
    kernel security and bug fix update
    • Red Hat Enterprise Linux EUS (v. 5.4 server) kernel-2.6.18-164.17.1.el5, kernel-2.6.18-164.17.1.el5.ia64, kernel-PAE-2.6.18-164.17.1.el5 +14
  • RHSA-2010:0331 Released 2010-03-30 · Red Hat rating Moderate
    GFS-kernel security and bug fix update
    • Red Hat Global File System 4AS GFS-kernel-2.6.9-85.2.el4_8.10, GFS-kernel-2.6.9-85.2.el4_8.10.ia64, GFS-kernel-hugemem-2.6.9-85.2.el4_8.10 +5
    • Red Hat Global File System 4ES GFS-kernel-2.6.9-85.2.el4_8.10, GFS-kernel-2.6.9-85.2.el4_8.10.ia64, GFS-kernel-hugemem-2.6.9-85.2.el4_8.10 +5
    • Red Hat Global File System 4WS GFS-kernel-2.6.9-85.2.el4_8.10, GFS-kernel-2.6.9-85.2.el4_8.10.ia64, GFS-kernel-hugemem-2.6.9-85.2.el4_8.10 +5
Show 3 more Red Hat advisories
  • RHSA-2010:0330 Released 2010-03-30 · Red Hat rating Moderate
    GFS security and bug fix update
    • Red Hat Global File System 3AS GFS-6.0.2.36-13, GFS-6.0.2.36-13.i386, GFS-6.0.2.36-13.ia32e +11
    • Red Hat Global File System 3ES GFS-6.0.2.36-13, GFS-6.0.2.36-13.i386, GFS-6.0.2.36-13.ia32e +11
    • Red Hat Global File System 3WS GFS-6.0.2.36-13, GFS-6.0.2.36-13.i386, GFS-6.0.2.36-13.ia32e +11
  • RHSA-2010:0291 Released 2010-03-29 · Red Hat rating Moderate
    gfs-kmod security, bug fix and enhancement update
    • Red Hat Enterprise Linux Cluster-Storage (v. 5 server) gfs-kmod-0.1.34-12.el5, kmod-gfs-0.1.34-12.el5, kmod-gfs-0.1.34-12.el5.ia64 +3
  • RHSA-2010:0178 Released 2010-03-29 · Red Hat rating Important
    Red Hat Enterprise Linux 5.5 kernel security and bug fix update
    • Red Hat Enterprise Linux (v. 5 server) kernel-2.6.18-194.el5, kernel-2.6.18-194.el5.ia64, kernel-PAE-2.6.18-194.el5 +14
    • Red Hat Enterprise Linux Desktop (v. 5 client) kernel-2.6.18-194.el5, kernel-PAE-2.6.18-194.el5, kernel-PAE-devel-2.6.18-194.el5 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHEL Cluster-Storage (v. 5.4.Z server)Fixed RHSA-2010:0521
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2010:0178
Red Hat Enterprise Linux Cluster-Storage (v. 5 server)Fixed RHSA-2010:0291
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2010:0178
Red Hat Enterprise Linux EUS (v. 5.4 server)Fixed RHSA-2010:0380
Not affected: 3 products
  • Red Hat Enterprise Linux (v. 5 server)
  • Red Hat Enterprise Linux Desktop (v. 5 client)
  • Red Hat Enterprise Linux EUS (v. 5.4 server)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-0727
  2. 2026-10-03 Alias added: GHSA-xfgm-rcpf-gf3q

References

Exploit 2

Patch 1

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences