CVE-2011-2517: Buffer Overflow
In both triggerscan and schedscan operations, we were checking for the SSID length before assigning the value correctly. Since the memory was just kzalloc'ed, the check was always failing and SSID with over 32 characters were allowed to go through.
This is causing a buffer overflow when copying the actual SSID to the proper place.
Upstream fixes: http://git.kernel.org/linus/208c72f4fe44fe09577e7975ba0e7fa0278f3d03 http://git.kernel.org/linus/57a27e1d6a3bb9ad4efeebd3a8c71156d6207536
Other sources
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAPNETADMIN capability during scan operations with a long SSID value.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2517?
CVE-2011-2517 is classified as a high severity vulnerability due to the potential for buffer overflow leading to system crashes or execution of arbitrary code.
How do I fix CVE-2011-2517?
To fix CVE-2011-2517, update the Linux kernel to a version newer than 2.6.39.2 or apply the relevant patches provided by your distribution.
What systems are affected by CVE-2011-2517?
CVE-2011-2517 affects several versions of the Linux kernel, including specific versions of Red Hat Enterprise Linux 5.0 and Debian linux-2.6 packages.
What type of vulnerability is CVE-2011-2517?
CVE-2011-2517 is a buffer overflow vulnerability that occurs due to improper checks on SSID length during certain operations.
What are the potential impacts of CVE-2011-2517?
The potential impacts of CVE-2011-2517 include system instability, crashes, and the possibility for an attacker to execute arbitrary code on the affected system.