TI-2010-03150 Aliases CVE-2010-3296 GHSA-276h-46x9-6jwr

The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel…

LOW 11CWE-200Published 2010-09-30 · Updated 2024-08-07

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Partial · None · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a CHELSIO_GET_QSET_NUM ioctl call.

Why it matters now

EPSS 0.00415 36th percentileScored 2026-11-07

Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPE	Versions	Role	Vendor
cpe:2.3:o:linux:linux_kernel::::::::	before 2.6.36	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:-::::::	2.6.36	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc1::::::	2.6.36 rc1	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc2::::::	2.6.36 rc2	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc3::::::	2.6.36 rc3	Vulnerable	Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc4::::::	2.6.36 rc4	Vulnerable	Linux
cpe:2.3:o:opensuse:opensuse:11.1:::::::*	11.1	Vulnerable	openSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:11:-::::::	11	Vulnerable	SUSE
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1::::::	11 sp1	Vulnerable	SUSE
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp1::::::	11 sp1	Vulnerable	SUSE

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions before 2.6.36 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:-:*:*:*:*:*:* Versions 2.6.36 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc1:*:*:*:*:*:* Versions 2.6.36 rc1 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc2:*:*:*:*:*:* Versions 2.6.36 rc2 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc3:*:*:*:*:*:* Versions 2.6.36 rc3 Vulnerable ·Linux
cpe:2.3:o:linux:linux_kernel:2.6.36:rc4:*:*:*:*:*:* Versions 2.6.36 rc4 Vulnerable ·Linux
cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:* Versions 11.1 Vulnerable ·openSUSE
cpe:2.3:o:suse:linux_enterprise_desktop:11:-:*:*:*:*:*:* Versions 11 Vulnerable ·SUSE
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:* Versions 11 sp1 Vulnerable ·SUSE
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp1:*:*:*:*:*:* Versions 11 sp1 Vulnerable ·SUSE

Show 6 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:suse:linux_enterprise_server:11:-::::::	11	Vulnerable	SUSE
cpe:2.3:o:suse:linux_enterprise_server:11:sp1::::::	11 sp1	Vulnerable	SUSE
cpe:2.3:o:debian:debian_linux:5.0:::::::*	5.0	Vulnerable	Debian
cpe:2.3:o:canonical:ubuntu_linux:9.10:::::::*	9.10	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::	10.04	Vulnerable	Canonical
cpe:2.3:o:canonical:ubuntu_linux:10.10:::::::*	10.10	Vulnerable	Canonical

cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:* Versions 11 Vulnerable ·SUSE
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:* Versions 11 sp1 Vulnerable ·SUSE
cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Debian
cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* Versions 10.04 Vulnerable ·Canonical
cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:* Versions 10.10 Vulnerable ·Canonical

Remediation

Red Hat 3 advisories

RHSA-2011:0421 Released 2011-04-08 · Red Hat rating Important
kernel security and bug fix update
- Red Hat Enterprise Linux Desktop (v. 6) kernel-2.6.32-71.24.1.el6, kernel-debug-2.6.32-71.24.1.el6, kernel-debug-devel-2.6.32-71.24.1.el6 +4
- Red Hat Enterprise Linux HPC Node (v. 6) kernel-2.6.32-71.24.1.el6, kernel-debug-2.6.32-71.24.1.el6, kernel-debug-devel-2.6.32-71.24.1.el6 +4
- Red Hat Enterprise Linux Server (v. 6) kernel-2.6.32-71.24.1.el6, kernel-bootwrapper-2.6.32-71.24.1.el6, kernel-debug-2.6.32-71.24.1.el6 +7
- Red Hat Enterprise Linux Workstation (v. 6) kernel-2.6.32-71.24.1.el6, kernel-debug-2.6.32-71.24.1.el6, kernel-debug-devel-2.6.32-71.24.1.el6 +4
RHSA-2011:0017 Released 2011-01-13 · Red Hat rating Important
Red Hat Enterprise Linux 5.6 kernel security and bug fix update
- Red Hat Enterprise Linux (v. 5 server) kernel-2.6.18-238.el5, kernel-2.6.18-238.el5.ia64, kernel-PAE-2.6.18-238.el5 +18
- Red Hat Enterprise Linux Desktop (v. 5 client) kernel-2.6.18-238.el5, kernel-PAE-2.6.18-238.el5, kernel-PAE-devel-2.6.18-238.el5 +8
RHSA-2010:0771 Released 2010-10-14 · Red Hat rating Moderate
kernel-rt security and bug fix update
- MRG Realtime for RHEL 5 Server kernel-rt-2.6.33.7-rt29.45.el5rt, kernel-rt-debug-2.6.33.7-rt29.45.el5rt, kernel-rt-debug-devel-2.6.33.7-rt29.45.el5rt +7

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
MRG Realtime for RHEL 5 Server	Fixed	RHSA-2010:0771
Red Hat Enterprise Linux (v. 5 server)	Fixed	RHSA-2011:0017
Red Hat Enterprise Linux Desktop (v. 5 client)	Fixed	RHSA-2011:0017
Red Hat Enterprise Linux Desktop (v. 6)	Fixed	RHSA-2011:0421
Red Hat Enterprise Linux HPC Node (v. 6)	Fixed	RHSA-2011:0421
Red Hat Enterprise Linux Server (v. 6)	Fixed	RHSA-2011:0421
Red Hat Enterprise Linux Workstation (v. 6)	Fixed	RHSA-2011:0421

Timeline

2026-10-02 Threatist record created from CVE-2010-3296
2026-10-03 Alias added: GHSA-276h-46x9-6jwr

References

Patch 2

Advisory 11

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences