CVE-2011-3353: Buffer Overflow
Buffer overflow in the fusenotifyinvalentry function in fs/fuse/dev.c in the Linux kernel before 3.1 allows local users to cause a denial of service (BUGON and system crash) by leveraging the ability to mount a FUSE filesystem.
Other sources
FUSENOTIFYINVALENTRY didn't check the length of the write so the message processing could overrun and result in a BUGON() in fusecopyfill().
User able to mount FUSE filesystems can use this flaw to crash the system.
References: http://permalink.gmane.org/gmane.linux.kernel.commits.head/313266 http://sourceforge.net/mailarchive/forum.php?threadname=87liut4i7w.fsf%40tucsk.pomaz.szeredi.hu&forumname=fuse-devel
Upstream fix: https://github.com/torvalds/linux/commit/c2183d1e9b3f313dd8ba2b1b0197c8d9fb86a7ae
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3353?
CVE-2011-3353 has a severity rating that can lead to denial of service causing system crashes.
How do I fix CVE-2011-3353?
To fix CVE-2011-3353, ensure you are using a Linux kernel version 3.1 or higher that addresses the buffer overflow vulnerability.
Who is affected by CVE-2011-3353?
Local users on systems running Linux kernels prior to version 3.1 that support FUSE are affected by CVE-2011-3353.
What impact does CVE-2011-3353 have on systems?
CVE-2011-3353 can lead to a denial of service condition resulting in system crashes due to improper handling of the FUSE_NOTIFY_INVAL_ENTRY.
Is CVE-2011-3353 a remote vulnerability?
No, CVE-2011-3353 is a local vulnerability that requires local user access to exploit.