CVE-2011-1745: Integer Overflow
Integer overflow in the agpgenericinsertmemory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allows local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOCBIND agpioctl ioctl call.
Other sources
pgstart is copied from userspace on AGPIOCBIND and AGPIOCUNBIND ioctl cmds of agpioctl() and passed to agpiocbindwrap(). As said in the comment, (pgstart + mem->pagecount) may wrap in case of AGPIOCBIND, and it is not checked at all in case of AGPIOCUNBIND. As a result, user with sufficient privileges (usually "video" group) may generate either local DoS or privilege escalation.
Reference and patch: https://lkml.org/lkml/2011/4/14/293
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.18-238.19.1.el5 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-131.17.1.el6 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:2.6.33.9-rt31.75.el6 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 2.6.38.5
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2011-1745?
CVE-2011-1745 has a high severity rating due to potential privilege escalation and system crashes.
How do I fix CVE-2011-1745?
To fix CVE-2011-1745, upgrade the Linux kernel to versions 2.6.38.5 or later.
Which versions of the Linux kernel are affected by CVE-2011-1745?
CVE-2011-1745 affects Linux kernel versions prior to 2.6.38.5.
What type of vulnerability is CVE-2011-1745?
CVE-2011-1745 is an integer overflow vulnerability found in the agp_generic_insert_memory function.
Can CVE-2011-1745 be exploited by local users?
Yes, local users can exploit CVE-2011-1745 to gain elevated privileges or cause a denial of service.