PT-2011-1074 · Linux+2 · Linux Kernel+3

Dan Rosenberg · Published 2011-03-01 · Updated 2023-02-13 · CVE-2011-1495

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel version 2.6.38 and earlier kernel-kdumppae (affected versions not specified)

Description The issue is related to a lack of validation of length and offset values before performing memory copy operations in the Linux kernel. This could allow local users to gain privileges, cause a denial of service, or obtain sensitive information from kernel memory via a crafted ioctl call. The functions ctl do mpt command and ctl diag read buffer are involved. Additionally, there are multiple vulnerabilities in the kernel-kdumppae package of SUSE Linux Enterprise that can be exploited remotely to disrupt the availability of protected information.

Recommendations For Linux kernel version 2.6.38 and earlier: consider upgrading to a newer version to address the issue. For kernel-kdumppae: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-04607

CVE-2011-1495

DSA-2240-1

RHSA-2011:0542

RHSA-2011:0833

RHSA-2011:0883

RHSA-2011:1253

RHSA-2011_0542

RHSA-2011_0833

RHSA-2011_0883

Affected Products

Linux Kernel

Red Hat

Suse

Kernel-Kdumppae

References · 21

• https://linux.oracle.com/errata/ELSA-2011-0542.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/04/05/32 · Patch
• https://linux.oracle.com/errata/ELSA-2011-2016.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1495 · Security Note
• https://bdu.fstec.ru/vul/2015-04607 · Security Note
• https://patchwork.kernel.org/patch/688021 · Patch
• http://lkml.org/lkml/2011/4/5/327 · Patch
• http://rhn.redhat.com/errata/RHSA-2011-0833.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=694021 · Patch
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/04/06/2 · Patch
• https://github.com/torvalds/linux/commit/982134ba62618c2d69fbbbd166d0a11ee3b7e3d8 · Note
• https://github.com/torvalds/linux/commit/4ff67b720c02c36e54d55b88c2931879b7db1cd2 · Note
• http://securityfocus.com/bid/47185 · Note
• http://groups.google.com/group/fa.linux.kernel/msg/4a28ecb7f755a88d?dmode=source · Note