Multiple vulnerabilities in Linux kernel

1) Information disclosure

EUVDB-ID: #VU44027

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2707

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local privileged user to #BASIC_IMPACT#.

The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0d0138ebe24b94065580bd2601f8bb7eb6152f56
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/07/20/18
http://github.com/torvalds/linux/commit/0d0138ebe24b94065580bd2601f8bb7eb6152f56

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU44029

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2011-2918

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a8b0ca17b80e92faab46ee7179ba9e99ccb61233
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/08/16/1
http://bugzilla.redhat.com/show_bug.cgi?id=730706
http://github.com/torvalds/linux/commit/a8b0ca17b80e92faab46ee7179ba9e99ccb61233

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Input validation error

EUVDB-ID: #VU44030

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3188

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6e5714eaf77d79ae1c8b47e3e040ff5411b717ec
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bc0b96b54a21246e377122d54569eef71cec535f
http://marc.info/?l=bugtraq&m=139447903326211&w=2
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/08/23/2
http://bugzilla.redhat.com/show_bug.cgi?id=732658
http://github.com/torvalds/linux/commit/6e5714eaf77d79ae1c8b47e3e040ff5411b717ec
http://github.com/torvalds/linux/commit/bc0b96b54a21246e377122d54569eef71cec535f
http://support.f5.com/csp/article/K15301?utm_source=f5support&utm_medium=RSS

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU44031

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3191

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9438fabb73eb48055b58b89fc51e0bc4db22fabd
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/08/24/2
http://bugzilla.redhat.com/show_bug.cgi?id=732869
http://github.com/torvalds/linux/commit/9438fabb73eb48055b58b89fc51e0bc4db22fabd

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU44032

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-3353

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

Buffer overflow in the fuse_notify_inval_entry function in fs/fuse/dev.c in the Linux kernel before 3.1 allows local users to cause a denial of service (BUG_ON and system crash) by leveraging the ability to mount a FUSE filesystem.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/09/09/6
http://bugzilla.redhat.com/show_bug.cgi?id=736761
http://github.com/torvalds/linux/commit/c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) NULL pointer dereference

EUVDB-ID: #VU44036

Risk: Medium

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-4081

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Update to version 3.1.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7ed47b7d142ec99ad6880bbbec51e9f12b3af74c
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/10/27/2
http://bugzilla.redhat.com/show_bug.cgi?id=749475
http://github.com/torvalds/linux/commit/7ed47b7d142ec99ad6880bbbec51e9f12b3af74c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU44040

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2699

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=87c48fa3b4630905f98268dde838ee43626a060c
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
http://www.openwall.com/lists/oss-security/2011/07/20/5
http://www.securitytracker.com/id?1027274
http://bugzilla.redhat.com/show_bug.cgi?id=723429
http://github.com/torvalds/linux/commit/87c48fa3b4630905f98268dde838ee43626a060c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) NULL pointer dereference

EUVDB-ID: #VU44074

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-4594

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The __sys_sendmsg function in net/socket.c in the Linux kernel before 3.1 allows local users to cause a denial of service (system crash) via crafted use of the sendmmsg system call, leading to an incorrect pointer dereference.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bc909d9ddbf7778371e36a651d6e4194b1cc7d4c
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/12/08/4
http://bugzilla.redhat.com/show_bug.cgi?id=761646
http://github.com/torvalds/linux/commit/bc909d9ddbf7778371e36a651d6e4194b1cc7d4c

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Input validation error

EUVDB-ID: #VU44081

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-4112

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The net subsystem in the Linux kernel before 3.1 does not properly restrict use of the IFF_TX_SKB_SHARING flag, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability to access /proc/net/pktgen/pgctrl, and then using the pktgen package in conjunction with a bridge device for a VLAN interface.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.101

CPE2.3

cpe:2.3:o:linux_foundation:linux_kernel:3.0.101:*:*:*:*:*:*:*

External links

http://downloads.avaya.com/css/P8/documents/100156038
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=550fd08c2cebad61c548def135f67aba284c6162
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
http://www.openwall.com/lists/oss-security/2011/11/21/4
http://bugzilla.redhat.com/show_bug.cgi?id=751006
http://github.com/torvalds/linux/commit/550fd08c2cebad61c548def135f67aba284c6162

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	9
CVE-ID	CVE-2011-2707 CVE-2011-2918 CVE-2011-3188 CVE-2011-3191 CVE-2011-3353 CVE-2011-4081 CVE-2011-2699 CVE-2011-4594 CVE-2011-4112
CWE-ID	CWE-200 CWE-400 CWE-20 CWE-119 CWE-120 CWE-476
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #2 is available.
Vulnerable software Subscribe	Linux kernel Operating systems & Components / Operating system
Vendor	Linux Foundation