CVE-2011-1745: Integer Overflow
Integer overflow in the agpgenericinsertmemory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOCBIND agpioctl ioctl call.
Other sources
pgstart is copied from userspace on AGPIOCBIND and AGPIOCUNBIND ioctl cmds of agpioctl() and passed to agpiocbindwrap(). As said in the comment, (pgstart + mem->pagecount) may wrap in case of AGPIOCBIND, and it is not checked at all in case of AGPIOCUNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation.
Reference and patch: https://lkml.org/lkml/2011/4/14/293
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2011-1745?
CVE-2011-1745 has a high severity rating due to potential privilege escalation and system crashes.
How do I fix CVE-2011-1745?
To fix CVE-2011-1745, upgrade the Linux kernel to versions 2.6.38.5 or later.
Which versions of the Linux kernel are affected by CVE-2011-1745?
CVE-2011-1745 affects Linux kernel versions prior to 2.6.38.5.
What type of vulnerability is CVE-2011-1745?
CVE-2011-1745 is an integer overflow vulnerability found in the agp_generic_insert_memory function.
Can CVE-2011-1745 be exploited by local users?
Yes, local users can exploit CVE-2011-1745 to gain elevated privileges or cause a denial of service.