CVE-2011-3637: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The mstop function in fs/proc/taskmmu.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (OOPS) via vectors that trigger an mstart error.
— Launchpad
When mstart returns an error, the seqfile logic will still call mstop with that error entry, so we'd better make sure that we check it before using it as a vma.
Introduced by commit ec6fd8a4355c ("report errors in /proc//map sanely"), which replaced NULL with various ERRPTR() cases.
(On ia64, you happen to get a unaligned fault instead of a page fault, since the address used is generally some random error code like -EPERM)
Upstream commit: http://git.kernel.org/linus/76597cd31470fa130784c78fadb4dab2e624a723
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3637?
CVE-2011-3637 has a moderate severity rating due to its potential to cause a denial of service.
How do I fix CVE-2011-3637?
To fix CVE-2011-3637, upgrade to Linux kernel version 2.6.39 or later.
Who is affected by CVE-2011-3637?
CVE-2011-3637 affects local users on Linux systems running kernel versions prior to 2.6.39.
What types of systems are impacted by CVE-2011-3637?
Systems running Debian Linux 2.6 and Red Hat Enterprise Linux 6.0 and earlier versions are impacted by CVE-2011-3637.
What is the exploit vector for CVE-2011-3637?
The exploit vector for CVE-2011-3637 involves triggering an m_start error that leads to an OOPS condition.