PT-2011-2830 · Linux+2 · Linux Kernel+2

Published 2011-02-18 · Updated 2020-08-12 · CVE-2011-1044

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.37

Description The issue concerns the ib uverbs poll cq function in the Linux kernel, which fails to initialize a certain response buffer. This allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled.

Recommendations For Linux kernel versions prior to 2.6.37, update to version 2.6.37 or later to resolve the issue. As a temporary workaround, consider restricting access to the ib uverbs poll cq function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-909

Related Identifiers

CVE-2011-1044

RHSA-2011:0330

RHSA-2011:0498

RHSA-2011:0927

RHSA-2011_0498

RHSA-2011_0927

SUSE-SU-2012_1391-1

Affected Products

Linux Kernel

Red Hat

Suse

References · 101

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2744 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2136 · Security Note
• https://bdu.fstec.ru/vul/2014-00069 · Security Note
• https://bdu.fstec.ru/vul/2015-04343 · Security Note
• http://rhn.redhat.com/errata/RHSA-2011-0927.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2663 · Security Note
• https://bdu.fstec.ru/vul/2014-00070 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=667916 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4110 · Security Note
• https://bdu.fstec.ru/vul/2015-04607 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1044 · Security Note
• https://bdu.fstec.ru/vul/2015-04341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2011-1044 · Security Note
• https://bdu.fstec.ru/vul/2015-04359 · Security Note
• https://bdu.fstec.ru/vul/2023-07716 · Security Note