CVE-2011-1079: Input Validation
Description of problem: Struct ca is copied from userspace. It is not checked whether the "device" field is NULL terminated. This potentially leads to BUG() inside of allocnetdevmqs() and/or information leak by creating a device with a name made of contents of kernel stack.
References: http://seclists.org/oss-sec/2011/q1/309 https://lkml.org/lkml/2011/2/14/50
Acknowledgements: Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Other sources
The bnepsockioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service (BUG and system crash), via a BNEPCONNADD command.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 2.6.39
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1079?
CVE-2011-1079 is categorized as a high-severity vulnerability due to its potential for causing kernel crashes and information leaks.
What impact does CVE-2011-1079 have on systems?
CVE-2011-1079 can lead to a crash in the kernel or an information leak, compromising system integrity.
How do I fix CVE-2011-1079?
To mitigate CVE-2011-1079, upgrade to a patched version of the Linux kernel that protects against this vulnerability.
Which Linux kernel versions are affected by CVE-2011-1079?
CVE-2011-1079 affects multiple versions of the Linux kernel, including versions from 2.6.38 up to 2.6.38.8.
Can CVE-2011-1079 be exploited remotely?
CVE-2011-1079 requires local access, but it could be exploited by local attackers to gain elevated privileges.