PT-2011-2365 · Linux+1 · Linux Kernel+1

Goldwyn Rodrigues · Published 2011-04-10 · Updated 2020-08-04 · CVE-2011-0463

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.39-rc1

Description The issue is related to the ocfs2 prepare page for write function in the Oracle Cluster File System 2 (OCFS2) subsystem, which does not properly handle holes that cross page boundaries. This allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file.

Recommendations For versions prior to 2.6.39-rc1, update to version 2.6.39-rc1 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0463

Affected Products

Linux Kernel

Ocfs2

References · 7

• 🔥 http://oss.oracle.com/pipermail/ocfs2-devel/2011-February/007846.html · Exploit
• 🔥 https://bugzilla.novell.com/show_bug.cgi?id=673037 · Exploit
• http://ubuntu.com/usn/USN-1146-1 · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.39-rc1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0463 · Security Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=272b62c1f0f6f742046e45b50b6fec98860208a0 · Note
• http://secunia.com/advisories/43966 · Note