CVE-2010-2537

HighCVSS 7.1/10Last modified Jun 16, 2026

Description

The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e6254689853b5
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/42758Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35Broken Link
http://www.openwall.com/lists/oss-security/2010/07/21/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/07/21/4Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/41847Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1041-1Third Party Advisory
http://www.vupen.com/english/advisories/2011/0070Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=616998Issue Tracking, Patch, Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2ebc3464781ad24474abcbd2274e6254689853b5
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/42758Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35Broken Link
http://www.openwall.com/lists/oss-security/2010/07/21/10Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2010/07/21/4Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/bid/41847Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1041-1Third Party Advisory
http://www.vupen.com/english/advisories/2011/0070Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=616998Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Sep 30, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-25385.5Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain s CVE-2010-25392.1Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to caus CVE-2010-254010.0mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that w CVE-2010-25416.8Buffer overflow in ftmulti.c in the ftmulti demo program in FreeType before 2.4.2 allows remote attackers to cause a denial of service (appl CVE-2010-25427.5Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a lo CVE-2010-25434.3Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary CVE-2010-25444.3Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Soluti CVE-2010-25454.3Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and CVE-2010-25469.3Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary c CVE-2010-25478.1Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service CVE-2010-25489.1IcedTea6 before 1.7.4 does not properly check property access, which allows unsigned apps to read and write arbitrary files.CVE-2010-25497.2Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Vista SP1 and SP2 and Server 2008 Gold and SP2 allows local use