Candidate: CVE-2010-2538
Description:
 The BTRFS_IOC_CLONE_RANGE ioctl was subject to an integer overflow
 in specifying offsets to copy from a file, which potentially allows a
 local user to read sensitive filesystem data.
References:
 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2ebc3464781ad24474abcbd2274e6254689853b5
Notes:
Bugs:
upstream: released (2.6.35)
2.6.32-upstream-stable: released (2.6.32.17) [8875b99]
linux-2.6: released (2.6.32-19) [bugfix/all/stable/2.6.32.17.patch]
2.6.26-lenny-security: N/A "no btrfs"
2.6.32-squeeze-security: released (2.6.32-19) [bugfix/all/stable/2.6.32.17.patch]