The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line.
| Product | Vendor | Version |
|---|---|---|
| n/a | n/a | WCN3910 |
| n/a | n/a | < 93a11608fb3720e1bc2b19a2649ac2b49cca1921 |