CVE-2010-4656

Vulnerability

The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before version 2.6.37 does not properly validate or allocate memory when writing reports to IOWarrior USB devices. A local attacker with physical access can craft a malicious USB device that sends a report with a large size field, triggering a heap-based buffer overflow. Affected versions: Linux kernel prior to 2.6.37. [1][2]

Exploitation

An attacker requires physical access to the target system to plug in a specially crafted USB device. No authentication is needed; the device is automatically recognized by the kernel. The attacker must supply a report with an oversized length value, causing the driver to overflow the heap buffer. [1][4]

Impact

Successful exploitation can lead to a denial of service (system crash) or potential privilege escalation to root, as the overflow can corrupt kernel memory. [1]

Mitigation

The vulnerability is fixed in Linux kernel version 2.6.37 and later. Distributions like Ubuntu have released updated packages (see USN-1146-1). Users should apply the kernel update or restrict physical access to USB ports. [1][2]