CVE-2011-4594: Null Pointer Dereference
First published: Thu Dec 08 2011(Updated: )
Dereferencing a user pointer directly from kernel-space without going through the copy_from_user family of functions is a bad idea. Two of such usages can be found in the sendmsg code path called from sendmmsg, added by upstream commit c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a. Usages are performed through memcmp() and memcpy() directly. Upstream fix: <a href="http://git.kernel.org/linus/bc909d9ddbf7778371e36a651d6e4194b1cc7d4c">http://git.kernel.org/linus/bc909d9ddbf7778371e36a651d6e4194b1cc7d4c</a> Acknowledgements: Red Hat would like to thank Tetsuo Handa for reporting this issue. Upstream acknowledges Mathieu Desnoyers as the original reporter.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | <3.1 | |
| debian/linux-2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=761646
- https://github.com/torvalds/linux/commit/bc909d9ddbf7778371e36a651d6e4194b1cc7d4c
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1
- http://www.openwall.com/lists/oss-security/2011/12/08/4
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bc909d9ddbf7778371e36a651d6e4194b1cc7d4c
- https://launchpad.net/bugs/cve/CVE-2011-4594
- http://git.kernel.org/linus/bc909d9ddbf7778371e36a651d6e4194b1cc7d4c
- https://rhn.redhat.com/errata/RHSA-2012-0350.html
- https://security-tracker.debian.org/tracker/CVE-2011-4594
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4594
- https://nvd.nist.gov/vuln/detail/CVE-2011-4594
- https://ubuntu.com/security/CVE-2011-4594
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-4594
- agent/author
- agent/severity
- agent/weakness
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/softwarecombine
- agent/tags
- agent/event
- agent/description
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- agent/trending
- vendor/linux
- canonical/linux linux kernel
- package-manager/debian