CVE-2011-1080: Input Validation
Description of problem: Struct tmp is copied from userspace. It is not checked whether the "name" field is NULL terminated. This may lead to buffer overflow and passing contents of kernel stack as a module name to trythenrequestmodule() and, consequently, to modprobe commandline. It would be seen by all userspace processes.
References: http://seclists.org/oss-sec/2011/q1/309 https://lkml.org/lkml/2011/2/14/51
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Other sources
The doreplace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAPNETADMIN capability to replace a table, and then reading a modprobe command line.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1080?
CVE-2011-1080 is classified as a medium severity vulnerability that can lead to a buffer overflow.
How do I fix CVE-2011-1080?
To fix CVE-2011-1080, upgrade to a patched version of the Linux kernel that addresses this vulnerability.
What type of systems are affected by CVE-2011-1080?
CVE-2011-1080 affects Linux kernel versions up to 2.6.38.8 and includes several release candidates.
What is the impact of CVE-2011-1080?
The impact of CVE-2011-1080 includes potential exploitability leading to the leakage of sensitive data from the kernel stack.
Who discovered CVE-2011-1080?
CVE-2011-1080 was reported by security researchers but specific credit is often shared in public security mailing lists.