CVE-2011-2534: Buffer Overflow
'buffer' string is copied from userspace. It is not checked whether it is zero terminated. This may lead to overflow inside of simplestrtoul(). Changli Gao suggested to copy not more than user supplied 'size' bytes.
It was introduced before the git epoch. Files "iptCLUSTERIP/" are root writable only by default, however, on some setups permissions might be relaxed to e.g. network admin user.
http://marc.info/?l=netfilter-devel&m=130036157327564&w=2
Proposed patch: http://git.kernel.org/?p=linux/kernel/git/kaber/nf-2.6.git;a=commitdiff;h=961ed183a9fd080cf306c659b8736007e44065a5
Acknowledgements:
Red Hat would like to thank Vasiliy Kulikov of Openwall for reporting this issue.
Other sources
Buffer overflow in the clusteripprocwrite function in net/ipv4/netfilter/iptCLUSTERIP.c in the Linux kernel before 2.6.39 might allow local users to cause a denial of service or have unspecified other impact via a crafted write operation, related to string data that lacks a terminating '\0' character.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2534?
CVE-2011-2534 has a medium severity rating due to the potential for buffer overflow vulnerabilities.
How do I fix CVE-2011-2534?
To fix CVE-2011-2534, ensure that user-supplied strings are properly null-terminated and limit the copied size based on user input.
Which versions of the Linux Kernel are affected by CVE-2011-2534?
CVE-2011-2534 affects Linux Kernel versions up to 2.6.39.
What kind of vulnerability is CVE-2011-2534?
CVE-2011-2534 is a buffer overflow vulnerability caused by copying unchecked user-supplied strings.
Who proposed a solution for CVE-2011-2534?
Changli Gao proposed a solution for CVE-2011-2534, suggesting that no more than the user-supplied size should be copied.