CVE-2011-1746: Buffer Overflow
Last updated 24 July 2024
Other sources
Multiple integer overflows in the (1) agpallocatememory and (2) agpcreateusermemory functions in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allow local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages.
— Launchpad
pagecount is copied from userspace. agpallocatememory() tries to check whether this number is too big, but doesn't take into account the wrap case. Also agpcreateusermemory() doesn't check whether allocsize is calculated from numagppages variable without overflow. This may lead to allocation of too small buffer with following buffer overflow.
Reference and patch: https://lkml.org/lkml/2011/4/14/294
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1746?
CVE-2011-1746 has a high severity rating due to its potential to cause system crashes and denial of service.
How do I fix CVE-2011-1746?
To fix CVE-2011-1746, update your Linux kernel to version 2.6.38.5 or later.
Which versions of the Linux kernel are affected by CVE-2011-1746?
CVE-2011-1746 affects the Linux kernel versions before 2.6.38.5.
Is CVE-2011-1746 exploitable by local users?
Yes, CVE-2011-1746 can be exploited by local users to trigger buffer overflows.
What are the potential impacts of CVE-2011-1746?
The potential impacts of CVE-2011-1746 include denial of service and system crashes.