PT-2011-2814 · Openbsd+2 · Openbsd Kernel+2

Published 2011-05-09 · Updated 2023-02-13 · CVE-2011-1013

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.38 OpenBSD kernel versions prior to 4.9

Description The issue is caused by an integer signedness error in the drm modeset ctl function, allowing local users to trigger out-of-bounds write operations. This can lead to a denial of service (system crash) or possibly have other unspecified impacts. The error occurs when a crafted num crtcs (also known as vb num) structure member is passed in an ioctl argument.

Recommendations For Linux kernel versions prior to 2.6.38, update to version 2.6.38 or later to resolve the issue. For OpenBSD kernel versions prior to 4.9, update to version 4.9 or later to resolve the issue.

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2011-1013

RHSA-2011:0498

RHSA-2011:0500

RHSA-2011_0498

Affected Products

Linux Kernel

Openbsd Kernel

Red Hat

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2011-1013 · Security Note
• https://bdu.fstec.ru/vul/2015-04607 · Security Note
• https://linux.oracle.com/errata/ELSA-2011-0498.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-2015.html · Vendor Advisory
• http://openbsd.org/cgi-bin/cvsweb/src/sys/dev/pci/drm/drm_irq.c · Patch
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=679925 · Patch
• https://github.com/torvalds/linux/commit/8909c9ad8ff03611c9c96c9a92656213e4bb495b · Note
• https://access.redhat.com/security/cve/CVE-2011-1079 · Note
• https://access.redhat.com/security/cve/CVE-2011-1093 · Note
• https://access.redhat.com/security/cve/CVE-2011-0712 · Note
• http://spinics.net/lists/netdev/msg145791.html · Note
• https://access.redhat.com/security/cve/CVE-2011-1016 · Note
• https://access.redhat.com/errata/RHSA-2011:0498 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=695383 · Note