PT-2011-1075 · Linux+2 · Linux Kernel+3

Eugene Teo · Published 2011-03-01 · Updated 2023-02-13 · CVE-2011-1585

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.36

Description The issue is related to the cifs find smb ses function in fs/cifs/connect.c, which does not properly determine the associations between users and sessions. This allows local users to bypass CIFS share authentication by leveraging a mount of a share by a different user. There is also mention of multiple vulnerabilities in the kernel-kdumppae package of SUSE Linux Enterprise, which can be exploited remotely to disrupt the availability of protected information.

Recommendations For Linux kernel versions prior to 2.6.36, update to version 2.6.36 or later to resolve the issue. As a temporary workaround, consider restricting access to shared mounts to minimize the risk of exploitation. Avoid using shared mounts of CIFS shares by different users until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for the kernel-kdumppae package vulnerabilities in SUSE Linux Enterprise.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-264

Related Identifiers

BDU:2015-04607

CVE-2011-1585

DSA-2240-1

RHSA-2011:1253

RHSA-2011:1386

RHSA-2011_1386

Affected Products

Linux Kernel

Red Hat

Suse Linux Enterprise

Suse

References · 14

• 🔥 https://github.com/torvalds/linux/commit/4ff67b720c02c36e54d55b88c2931879b7db1cd2 · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4ff67b720c02c36e54d55b88c2931879b7db1cd2 · Exploit
• https://linux.oracle.com/errata/ELSA-2011-2037.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1585 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=697394 · Patch
• https://bdu.fstec.ru/vul/2015-04607 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html · Vendor Advisory
• https://github.com/torvalds/linux/commit/982134ba62618c2d69fbbbd166d0a11ee3b7e3d8 · Note
• http://groups.google.com/group/fa.linux.kernel/msg/4a28ecb7f755a88d?dmode=source · Note
• https://suse.com/support/security/advisories/2011_34_kernel.html · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4ff67b720c02c36e54d55b88c2931879b7db1cd2 · Note
• http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.36 · Note
• http://openwall.com/lists/oss-security/2011/04/15/8 · Note
• http://openwall.com/lists/oss-security/2011/02/24/4 · Note