CVE-2011-1593: Integer Overflow
A signedness issue has been found in nextpidmap() function when the "last" parameter is negative as nextpidmap() just quietly accepted whatever "last" pid that was passed in, which is not all that safe when one of the users is /proc.
Setting fpos to negative value when accessing /proc via readdir()/getdents() resulted in sign extension of this value when map pointer was being constructed.
This later lead to #GP becasue the final pointer was not cannonical (x8664).
map = &pidns->pidmap[(last + 1)/BITSPERPAGE]; ffffffff810ac3b4: 48 63 f6 movslq %esi,%rsi <- sign extension (fpos+-) ffffffff810ac3b7: 81 e2 ff 7f 00 00 and $0x7fff,%edx ffffffff810ac3bd: 48 c1 ee 0f shr $0xf,%rsi ffffffff810ac3c1: 48 c1 e6 04 shl $0x4,%rsi ffffffff810ac3c5: 48 8d 5c 37 08 lea 0x8(%rdi,%rsi,1),%rbx ... if (unlikely(!map->page)) ffffffff810ac3cc: 48 8b 7b 08 mov 0x8(%rbx),%rdi <- #GP
Only x8664 architecture seems to be vulnerable to this particular issue (tested ppc64, s390x, ia64).
Reference: http://groups.google.com/group/fa.linux.kernel/browsethread/thread/93c1088451fd3522/4a28ecb7f755a88d?#4a28ecb7f755a88d
Upstream commit: http://git.kernel.org/linus/c78193e9 http://git.kernel.org/linus/d8bdc59f
Acknowledgements:
Red Hat would like to thank Robert Swiecki for reporting this issue.
Other sources
Multiple integer overflows in the nextpidmap function in kernel/pid.c in the Linux kernel before 2.6.38.4 allow local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir system call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1593?
CVE-2011-1593 is classified as a medium severity vulnerability due to its potential impact on system security.
How do I fix CVE-2011-1593?
To mitigate CVE-2011-1593, users should upgrade to a version of the Linux kernel that is beyond 2.6.38.4.
Who is affected by CVE-2011-1593?
CVE-2011-1593 affects users of Linux kernel versions prior to 2.6.38.4, particularly those running older distributions of Red Hat Enterprise Linux and Ubuntu.
What type of vulnerability is CVE-2011-1593?
CVE-2011-1593 is a signedness issue found in the next_pidmap() function of the Linux kernel.
Can CVE-2011-1593 be exploited remotely?
CVE-2011-1593 can be exploited if an attacker has local access to the vulnerable system, increasing the risk of privilege escalation.