CVE-2011-1493: High severity linux kernel vulnerability
"When parsing the FACNATIONALDIGIS facilities field, it's possible for a remote host to provide more digipeaters than expected, resulting in heap corruption. Check against ROSEMAXDIGIS to prevent overflows, and abort facilities parsing on failure.
Additionally, when parsing the FACCCITTDESTNSAP and FACCCITTSRCNSAP facilities fields, a remote host can provide a length of less than 10, resulting in an underflow in a memcpy size, causing a kernel panic due to massive heap corruption. A length of greater than 20 results in a stack overflow of the callsign array. Abort facilities parsing on these invalid length values."
These issues may both result in code execution. They may be triggered by a remote attacker if the victim has a listening ROSE socket, or by a local attacker (for privilege escalation) if a ROSE device exists (e.g. rose0).
Ben Hutchings followed up with a patch [2] that resolves a number of other ROSE issues related to lack of size field validation, some of which may also result in heap corruption.
[1] http://marc.info/?l=linux-netdev&m=130060344616926 [2] http://marc.info/?l=linux-netdev&m=130063972406389&w=2
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
Array index error in the roseparsenational function in net/rose/rosesubr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FACNATIONALDIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1493?
CVE-2011-1493 is classified as a moderate severity vulnerability due to potential heap corruption.
How do I fix CVE-2011-1493?
To mitigate CVE-2011-1493, ensure that the software is updated to a patched version of the Linux Kernel beyond 2.6.38.7.
What type of vulnerability is CVE-2011-1493?
CVE-2011-1493 is a heap overflow vulnerability that can be triggered by an unexpected number of digipeaters.
Which versions of Linux Kernel are affected by CVE-2011-1493?
CVE-2011-1493 affects Linux Kernel versions 2.6.38 and earlier, including various 2.6.38 release candidates.
Can CVE-2011-1493 be exploited remotely?
Yes, CVE-2011-1493 can be exploited remotely by delivering crafted packets to the vulnerable system.