CVE-2010-2803

Exp

The drm_ioctl function in drivers/gpu/drm/drm_drv.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.27.53, 2.6.32.x before 2.6.32.21, 2.6.34.x before 2.6.34.6, and 2.6.35.x before 2.6.35.4 allows local users to obtain potentially sensitive information from kernel memory by requesting a large memory-allocation amount.

Published: 2010-09-08 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2010-2803 is rated Exploit Available (50/100): CVSS Low severity, with low exploitation likelihood (EPSS 0.47%). 1 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2010-2803

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2010-2803

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 0.08% 0.47% +0.38%
2 2025-03-17 0.04% 0.08% +0.04%
3 2023-03-07 — 0.04% —

Full EPSS history (4 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2010-2803

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
1.9 2.0 LOW
AV:L/AC:M/Au:N/C:P/I:N/A:N Click to expand
Access vector (AV:L)
Requires local access to the target system.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:P)
Partial confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:N)
No availability impact.
 3.4 2.9 [email protected]

Weakness enumeration for CVE-2010-2803

OS Trackers for CVE-2010-2803

vendor priority summary link
redhat medium — https://access.redhat.com/security/cve/CVE-2010-2803
ubuntu medium CVE-2010-2803 medium priority: Ubuntu including 5 source packages (linux, linux-ec2, linux-fsl-imx51, linux-mvl-dove, linux-source-2.6.15), 32 status rows across 7 suites (dapper, hardy, jaunty, karmic, lucid, maverick, upstream): DNE 13, released 11, not-affected 4, needs-triage 3, ignored 1. https://ubuntu.com/security/CVE-2010-2803

Affected software / configurations for CVE-2010-2803

Vendor Product Version Raw CPE
linux linux_kernel < 2.6.27.53 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 2.6.32, < 2.6.32.21 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 2.6.34, < 2.6.34.6 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 2.6.35, < 2.6.35.4 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
debian debian_linux 5.0 cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*
opensuse opensuse 11.1 cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*
opensuse opensuse 11.3 cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*
suse linux_enterprise_desktop 11 cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*
suse linux_enterprise_high_availability_extension 11 cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp1:*:*:*:*:*:*
suse linux_enterprise_real_time 11 cpe:2.3:o:suse:linux_enterprise_real_time:11:sp1:*:*:*:*:*:*
suse linux_enterprise_server 11 cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*

References for CVE-2010-2803

URL Tags
http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=1b2f1489633888d4a06028315dc19d65768a1c05
http://git.kernel.org/?p=linux/kernel/git/airlied/drm-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9f0aee83335db1f3915f4e42a5e21b351740afd
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00004.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00005.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00000.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00000.html Mailing List Third Party Advisory
http://secunia.com/advisories/41512 Broken Link
http://www.debian.org/security/2010/dsa-2094 Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.27.53 Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.32.21 Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34.6 Broken Link
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.35.4 Broken Link
http://www.mandriva.com/security/advisories?name=MDVSA-2010:198 Broken Link
http://www.redhat.com/support/errata/RHSA-2010-0842.html Broken Link
http://www.vupen.com/english/advisories/2010/2430 Broken Link
http://www.vupen.com/english/advisories/2011/0298 Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=621435 Exploit Issue Tracking Patch Third Party Advisory
cvelogic Threat Intelligence