CVE-2010-4805

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The socket implementation in net/core/sock.c in the Linux kernel before 2.6.35 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service by sending a large amount of network traffic, related to the sk_add_backlog function and the sk_rmem_alloc socket field. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4251.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c377411f2494a931ff7facdbb3a6839b1266bcf6
http://kerneltrap.org/mailarchive/linux-netdev/2010/3/3/6271093/threadBroken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35Broken Link
http://www.securityfocus.com/bid/46637Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=657303Issue Tracking, Patch, Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c377411f2494a931ff7facdbb3a6839b1266bcf6
http://kerneltrap.org/mailarchive/linux-netdev/2010/3/3/6271093/threadBroken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35Broken Link
http://www.securityfocus.com/bid/46637Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=657303Issue Tracking, Patch, Third Party Advisory

Timeline

Published: May 26, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-48064.0The authoring tool in IBM Web Content Manager (WCM) 6.1.5, and 7.0.0.1 before CF003, allows remote authenticated users to bypass intended ac CVE-2010-48073.5Race condition in IBM Web Content Manager (WCM) 7.0.0.1 before CF003 allows remote authenticated users to cause a denial of service (infinit CVE-2010-48087.5SQL injection vulnerability in index.php in Webmatic allows remote attackers to execute arbitrary SQL commands via the p parameter.CVE-2010-48097.5SQL injection vulnerability in index.php in DBSite 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.CVE-2010-48107.5Multiple PHP remote file inclusion vulnerabilities in AR Web Content Manager (AWCM) 2.1 final allow remote attackers to execute arbitrary PH CVE-2010-48114.3Multiple cross-site scripting (XSS) vulnerabilities in ajaxmember.php in 6kbbs 8.0 build 20100901 allow remote attackers to inject arbitrary CVE-2010-48126.5Multiple SQL injection vulnerabilities in 6kbbs 8.0 build 20100901 allow remote attackers to execute arbitrary SQL commands via the (1) tids CVE-2010-48133.5Cross-site scripting (XSS) vulnerability in the Category Tokens module 6.x before 6.x-1.1 for Drupal allows remote authenticated users with CVE-2010-48147.5SQL injection vulnerability in index1.php in Best Soft Inc. (BSI) Advance Hotel Booking System 1.0 allows remote attackers to execute arbitr CVE-2010-48159.8Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution.CVE-2010-48167.5It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of servi CVE-2010-48175.5pithos before 0.3.5 allows overwrite of arbitrary files via symlinks.