PT-2012-1505 · Linux+2 · Linux Kernel+2

Gustavo F. Padovan + 1 · Published 2011-05-31 · Updated 2023-02-13 · CVE-2011-1078

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.39

Description The issue is related to the sco sock getsockopt old function in the Linux kernel, which does not properly initialize a certain structure. This allows local users to potentially obtain sensitive information from kernel stack memory via the SCO CONNINFO option.

Recommendations For versions prior to 2.6.39, update to version 2.6.39 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CESA-2012_1156

CVE-2011-1078

DSA-2240-1

DSA-2264-1

RHSA-2011:0500

RHSA-2011:0833

RHSA-2011_0833

RHSA-2012:1156

RHSA-2012_1156

Affected Products

Centos

Linux Kernel

Red Hat

References · 10

• https://github.com/torvalds/linux/commit/c4c896e1471aec3b004a693c689f60be3b17ac86 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1078 · Security Note
• https://linux.oracle.com/errata/ELSA-2012-1156.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-0833.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1156.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/03/01/10 · Note
• http://downloads.avaya.com/css/P8/documents/100145416 · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c4c896e1471aec3b004a693c689f60be3b17ac86 · Note
• http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=681259 · Note