CVE-2010-0453

The ucode_ioctl function in intel/io/ucode_drv.c in Sun Solaris 10 and OpenSolaris snv_69 through snv_133, when running on x86 architectures, allows local users to cause a denial of service (panic) via a request with a 0 size value to the UCODE_GET_VERSION IOCTL, which triggers a NULL pointer dereference in the ucode_get_rev function, related to retrieval of the microcode revision.

• sun opensolaris snv 69 • sun opensolaris snv 70 • sun opensolaris snv 71 • sun opensolaris snv 72 • sun opensolaris snv 73 • sun opensolaris snv 74 • sun opensolaris snv 75 • sun opensolaris snv 76 • sun opensolaris snv 77 • sun opensolaris snv 78 • sun opensolaris snv 79 • sun opensolaris snv 80 • sun opensolaris snv 81 • sun opensolaris snv 82 • sun opensolaris snv 83 • sun opensolaris snv 84 • sun opensolaris snv 85 • sun opensolaris snv 86 • sun opensolaris snv 87 • sun opensolaris snv 88 • sun opensolaris snv 89 • sun opensolaris snv 90 • sun opensolaris snv 91 • sun opensolaris snv 92 • sun opensolaris snv 93 • sun opensolaris snv 94 • sun opensolaris snv 95 • sun opensolaris snv 96 • sun opensolaris snv 97 • sun opensolaris snv 98 • sun opensolaris snv 99 • sun opensolaris snv 100 • sun opensolaris snv 101 • sun opensolaris snv 102 • sun opensolaris snv 103 • sun opensolaris snv 104 • sun opensolaris snv 105 • sun opensolaris snv 106 • sun opensolaris snv 107 • sun opensolaris snv 108 • sun opensolaris snv 109 • sun opensolaris snv 110 • sun opensolaris snv 111 • sun opensolaris snv 112 • sun opensolaris snv 113 • sun opensolaris snv 114 • sun opensolaris snv 115 • sun opensolaris snv 116 • sun opensolaris snv 117 • sun opensolaris snv 118 • sun opensolaris snv 119 • sun opensolaris snv 120 • sun opensolaris snv 121 • sun opensolaris snv 122 • sun opensolaris snv 123 • sun opensolaris snv 124 • sun opensolaris snv 125 • sun opensolaris snv 126 • sun opensolaris snv 127 • sun opensolaris snv 128 … and 6 more