CVE-2011-2496: Integer Overflow
Integer overflow in the vmatoresize function in mm/mremap.c in the L ...
Other sources
The normal mmap paths all avoid creating a mapping where the pgoff inside the mapping could wrap around due to overflow. However, an expanding mremap() can take such a non-wrapping mapping and make it bigger and cause a wrapping condition. There is also another case where we expand mappings hiding in plain sight: the automatic stack expansion.
The wrapping condition can cause a BUGON() due to terminally confusing the vmapriotree code.
Upstream patches: 982134ba62618c2d69fbbbd166d0a11ee3b7e3d8 mremap a626ca6a656450e9f4df91d0dda238fff23285f4 stack expansion downwards 42c36f63ac1366ab0ecc2d5717821362c259f517 stack expansion upwards
References: http://www.spinics.net/lists/stable-commits/msg11385.html http://www.spinics.net/lists/linux-mm/msg17093.html http://groups.google.com/group/fa.linux.kernel/msg/9e43ab898c5e6d16
Acknowledgements:
Red Hat would like to thank Robert Swiecki for reporting this issue.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2496?
CVE-2011-2496 has been classified as high severity due to the potential for denial of service and system crashes.
How can I fix CVE-2011-2496?
To fix CVE-2011-2496, you should upgrade to a patched version of the Linux kernel that is not vulnerable, specifically version 2.6.39 or later.
Who is affected by CVE-2011-2496?
CVE-2011-2496 affects local users of the Linux kernel versions before 2.6.39.
What type of attack does CVE-2011-2496 enable?
CVE-2011-2496 enables a denial of service attack that can lead to a system crash through a crafted mremap system call.
What versions of the Linux kernel are vulnerable to CVE-2011-2496?
Linux kernel versions before 2.6.39, including 2.6.38 and earlier release candidates, are vulnerable to CVE-2011-2496.