CVE-2011-1479: Double Free
Double free vulnerability in the inotify subsystem in the Linux kernel ...
Other sources
Originally, the CVE-2010-4250 identifier has been assigned to the following vulnerability:
Memory leak in the inotifyinit() system call could, in some cases, leak a group, allowing a local, unprivileged user to eventually cause a denial of service.
References: [1] https://bugzilla.redhat.com/showbug.cgi?id=CVE-2010-4250
Later, it was found that relevant upstream commit: a2ae4cc9a16e211c8a128ba10d22a85431f093ab, v2.6.37-rc5
did not properly address the issue / introduced a regression (slab corruption by double free of userstruct in inotifyinit1), which could allow a local, unprivileged user to cause a denial of service (kernel crash).
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.6.39
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1479?
CVE-2011-1479 has a severity rating that can lead to a denial of service condition, causing system crashes.
How do I fix CVE-2011-1479?
To fix CVE-2011-1479, update the Linux kernel to version 2.6.39 or later.
What causes the vulnerability identified as CVE-2011-1479?
CVE-2011-1479 is caused by a double free vulnerability in the inotify subsystem of the Linux kernel.
Which versions of the Linux kernel are affected by CVE-2011-1479?
CVE-2011-1479 affects Linux kernel versions prior to 2.6.39, including several earlier release candidates.
Can CVE-2011-1479 be exploited remotely?
CVE-2011-1479 is a local vulnerability, meaning it can only be exploited by local users on the affected system.