PT-2010-5668 · Linux+1 · Linux Kernel+4

Segoon + 1 · Published 1970-01-01 · Updated 2023-02-13 · CVE-2011-2909

Positive Technologies (AI Summary)

CVSS v2.0

5.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise versions prior to the fixed version btrfs-kmp-xen versions (affected versions not specified) btrfs-kmp-pae versions (affected versions not specified) kernel-desktop-devel versions (affected versions not specified)

Description The issue affects the SUSE Linux Enterprise operating system, specifically the btrfs-kmp-xen, btrfs-kmp-pae, and kernel-desktop-devel packages. Exploitation of the vulnerabilities can lead to a breach of confidentiality, integrity, and availability of protected information. The vulnerabilities can be exploited locally. The do devinfo ioctl function in the Linux kernel is also affected, allowing local users to obtain sensitive information from kernel memory.

Recommendations For btrfs-kmp-xen, consider disabling the vulnerable package until a patch is available. For btrfs-kmp-pae, restrict access to the vulnerable package to minimize the risk of exploitation. For kernel-desktop-devel, avoid using the vulnerable package until the issue is resolved. As a temporary workaround, consider disabling the do devinfo ioctl function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-04341

BDU:2015-04342

BDU:2015-04343

CVE-2011-2909

DSA-2303-1

Affected Products

Linux Kernel

Suse Linux Enterprise

Btrfs-Kmp-Pae

Btrfs-Kmp-Xen

Kernel-Desktop-Devel

References · 11

• https://bdu.fstec.ru/vul/2015-04341 · Security Note
• https://bdu.fstec.ru/vul/2015-04343 · Security Note
• https://bdu.fstec.ru/vul/2015-04342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-2909 · Security Note
• https://github.com/torvalds/linux/commit/1d1221f375c94ef961ba8574ac4f85c8870ddd51 · Note
• https://github.com/torvalds/linux/commit/819cbb120eaec7e014e5abd029260db1ca8c5735 · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=819cbb120eaec7e014e5abd029260db1ca8c5735 · Note
• http://openwall.com/lists/oss-security/2011/08/12/1 · Note
• https://kernel.org/pub/linux/kernel/v3.x/patch-3.1.bz2 · Note
• http://xorl.wordpress.com/2011/07/24/cve-2011-2700-linux-kernel-si4713-i2c-buffer-overflow · Note
• http://lists.opensuse.org/opensuse-security-announce/2011-09/msg00004.html · Note