PT-2011-4842 · Linux+3 · Linux Kernel+3

Nick Bowler · Published 2011-10-29 · Updated 2023-02-13 · CVE-2011-4081

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.1

Description The issue allows local users to cause a denial of service, potentially resulting in a NULL pointer dereference and OOPS, or possibly have other unspecified impacts. This can be triggered by a failed or missing ghash setkey function call, followed by either a ghash update function call or a ghash final function call, as demonstrated by a write operation on an AF ALG socket.

Recommendations For Linux kernel versions prior to 3.1, update to version 3.1 or later to resolve the issue.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CESA-2012_0350

CVE-2011-4081

RHSA-2012:0010

RHSA-2012:0350

RHSA-2012_0350

USN-1286-1

USN-1287-1

USN-1292-1

USN-1293-1

USN-1294-1

USN-1299-1

USN-1301-1

USN-1302-1

USN-1303-1

USN-1304-1

USN-1311-1

USN-1312-1

USN-1313-1

USN-1322-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

References · 25

• 🔥 https://github.com/torvalds/linux/commit/7ed47b7d142ec99ad6880bbbec51e9f12b3af74c · Exploit
• https://ubuntu.com/security/notices/USN-1312-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1299-1 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/10/27/2 · Patch
• https://ubuntu.com/security/notices/USN-1303-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-4081 · Security Note
• https://ubuntu.com/security/notices/USN-1313-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1286-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-4081 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1294-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1302-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=749475 · Patch
• https://linux.oracle.com/errata/ELSA-2012-0350.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4081 · Security Note
• https://ubuntu.com/security/CVE-2011-4081 · Vendor Advisory