PT-2011-2916 · Linux · Linux Kernel

Dan Rosenberg · Published 2011-05-03 · Updated 2023-02-13 · CVE-2011-1169

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.38.1

Description The issue is related to an array index error in the asihpi hpi ioctl function, located in the sound/pci/asihpi/hpioctl.c file of the AudioScience HPI driver. This error might allow local users to cause a denial of service, resulting in memory corruption, or possibly gain privileges. The exploitation is potentially achievable via a crafted adapter index value that triggers access to an invalid kernel pointer.

Recommendations For Linux kernel versions prior to 2.6.38.1, update to version 2.6.38.1 or later to resolve the issue.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2011-1169

Affected Products

Linux Kernel

References · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=688898 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1169 · Security Note
• http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38.1 · Vendor Advisory
• http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git%3Ba=commit%3Bh=4a122c10fbfe9020df469f0f669da129c5757671 · Note
• http://openwall.com/lists/oss-security/2011/03/18/2 · Note
• http://openwall.com/lists/oss-security/2011/03/18/1 · Note