The ldm_frag_add function in fs/partitions/ldm.c in the Linux kernel before 2.6.39.1 does not properly handle memory allocation for non-initial fragments, which might allow local users to conduct buffer overflow attacks, and gain privileges or obtain sensitive information, via a crafted LDM partition table. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1017.

The openSUSE 11.4 kernel was updated to 2.6.37.6 fixing lots of bugs and security issues.

Following security issues have been fixed: CVE-2011-2495: The /proc/PID/io interface could be used by local attackers to gain information on other processes like number of password characters typed or similar.

CVE-2011-2484: The add_del_listener function in kernel/taskstats.c in the Linux kernel did not prevent multiple registrations of exit handlers, which allowed local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application.

CVE-2011-2022: The agp_generic_remove_memory function in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 did not validate a certain start parameter, which allowed local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_UNBIND agp_ioctl ioctl call, a different vulnerability than CVE-2011-1745.

CVE-2011-1745: Integer overflow in the agp_generic_insert_memory function in drivers/char/agp/generic.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (system crash) via a crafted AGPIOC_BIND agp_ioctl ioctl call.

CVE-2011-2493: A denial of service on mounting invalid ext4 filesystems was fixed.

CVE-2011-2491: A local unprivileged user able to access a NFS filesystem could use file locking to deadlock parts of an nfs server under some circumstance.

CVE-2011-2498: Also account PTE pages when calculating OOM scoring, which could have lead to a denial of service.

CVE-2011-2496: The normal mmap paths all avoid creating a mapping where the pgoff inside the mapping could wrap around due to overflow.
However, an expanding mremap() can take such a non-wrapping mapping and make it bigger and cause a wrapping condition.

CVE-2011-1017,CVE-2011-2182: The code for evaluating LDM partitions (in fs/partitions/ldm.c) contained bugs that could crash the kernel for certain corrupted LDM partitions.

CVE-2011-1479: A regression in inotify fix for a memory leak could lead to a double free corruption which could crash the system.

CVE-2011-1927: A missing route validation issue in ip_expire() could be used by remote attackers to trigger a NULL ptr dereference, crashing parts of the kernel.

CVE-2011-1593: Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel allowed local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir system call.

CVE-2011-1020: The proc filesystem implementation in the Linux kernel did not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allowed local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.

The openSUSE 11.3 kernel was updated to 2.6.34.10 to fix various bugs and security issues.

Following security issues have been fixed: CVE-2011-2495: The /proc/PID/io interface could be used by local attackers to gain information on other processes like number of password characters typed or similar.

CVE-2011-2484: The add_del_listener function in kernel/taskstats.c in the Linux kernel did not prevent multiple registrations of exit handlers, which allowed local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application.

CVE-2011-2491: A local unprivileged user able to access a NFS filesystem could use file locking to deadlock parts of an nfs server under some circumstance.

CVE-2011-2496: The normal mmap paths all avoid creating a mapping where the pgoff inside the mapping could wrap around due to overflow.
However, an expanding mremap() can take such a non-wrapping mapping and make it bigger and cause a wrapping condition.

CVE-2011-1017,CVE-2011-2182: The code for evaluating LDM partitions (in fs/partitions/ldm.c) contained bugs that could crash the kernel for certain corrupted LDM partitions.

CVE-2011-1479: A regression in inotify fix for a memory leak could lead to a double free corruption which could crash the system.

CVE-2011-1593: Multiple integer overflows in the next_pidmap function in kernel/pid.c in the Linux kernel allowed local users to cause a denial of service (system crash) via a crafted (1) getdents or (2) readdir system call.

CVE-2011-1020: The proc filesystem implementation in the Linux kernel did not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allowed local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.

CVE-2011-1585: When using a setuid root mount.cifs, local users could hijack password protected mounted CIFS shares of other local users.

CVE-2011-1160: Kernel information via the TPM devices could by used by local attackers to read kernel memory.

CVE-2011-1577: The Linux kernel automatically evaluated partition tables of storage devices. The code for evaluating EFI GUID partitions (in fs/partitions/efi.c) contained a bug that causes a kernel oops on certain corrupted GUID partition tables, which might be used by local attackers to crash the kernel or potentially execute code.

CVE-2011-1180: In the IrDA module, length fields provided by a peer for names and attributes may be longer than the destination array sizes and were not checked, this allowed local attackers (close to the irda port) to potentially corrupt memory.

CVE-2011-1016: The Radeon GPU drivers in the Linux kernel did not properly validate data related to the AA resolve registers, which allowed local users to write to arbitrary memory locations associated with (1) Video RAM (aka VRAM) or (2) the Graphics Translation Table (GTT) via crafted values.

CVE-2011-1013: A signedness issue in the drm ioctl handling could be used by local attackers to potentially overflow kernel buffers and execute code.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-2037 advisory.

  - The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the     /proc directory tree of a process after this process performs an exec of a setuid program, which allows     local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write     system calls. (CVE-2011-1020)

  - Heap-based buffer overflow in the is_gpt_valid function in fs/partitions/efi.c in the Linux kernel 2.6.38     and earlier allows physically proximate attackers to cause a denial of service (OOPS) or possibly have     unspecified other impact via a crafted size of the EFI GUID partition-table header on removable media.
    (CVE-2011-1577)

  - The cifs_find_smb_ses function in fs/cifs/connect.c in the Linux kernel before 2.6.36 does not properly     determine the associations between users and sessions, which allows local users to bypass CIFS share     authentication by leveraging a mount of a share by a different user. (CVE-2011-1585)

  - fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io     files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by     discovering the length of another user's password. (CVE-2011-2495)

  - The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent     tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local     users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other     impact via a crafted call. (CVE-2011-2525)

  - fs/ext4/extents.c in the Linux kernel before 3.0 does not mark a modified extent as dirty in certain cases     of extent splitting, which allows local users to cause a denial of service (system crash) via vectors     involving ext4 umount and mount operations. (CVE-2011-3638)

  - The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to     cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined     key and updating a negative key into a fully instantiated key. (CVE-2011-4110)

  - Stack-based buffer overflow in the hfs_mac2asc function in fs/hfs/trans.c in the Linux kernel 2.6 allows     local users to cause a denial of service (crash) and possibly execute arbitrary code via an HFS image with     a crafted len field. (CVE-2011-4330)

  - The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not     validate user-space pointers, which allows local users to obtain sensitive information from kernel memory     locations via a crafted PTRACE_SETXTREGS request. (CVE-2011-2707)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This kernel update for the SUSE Linux Enterprise 10 SP3 kernel fixes several security issues and bugs.

The following security issues have been fixed :

  - A signedness issue in CIFS could possibly have lead to     to memory corruption, if a malicious server could send     crafted replies to the host. (CVE-2011-3191)

  - Timo Warns reported an issue in the Linux implementation     for GUID partitions. Users with physical access could     gain access to sensitive kernel memory by adding a     storage device with a specially crafted corrupted     invalid partition table. (CVE-2011-1776)

  - The dccp_rcv_state_process function in net/dccp/input.c     in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel did not properly     handle packets for a CLOSED endpoint, which allowed     remote attackers to cause a denial of service (NULL     pointer dereference and OOPS) by sending a DCCP-Close     packet followed by a DCCP-Reset packet. (CVE-2011-1093)

  - Integer overflow in the agp_generic_insert_memory     function in drivers/char/agp/generic.c in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (system crash) via a crafted     AGPIOC_BIND agp_ioctl ioctl call. (CVE-2011-1745)

  - Multiple integer overflows in the (1)     agp_allocate_memory and (2) agp_create_user_memory     functions in drivers/char/agp/generic.c in the Linux     kernel allowed local users to trigger buffer overflows,     and consequently cause a denial of service (system     crash) or possibly have unspecified other impact, via     vectors related to calls that specify a large number of     memory pages. (CVE-2011-1746)

  - The agp_generic_remove_memory function in     drivers/char/agp/generic.c in the Linux kernel before     2.6.38.5 did not validate a certain start parameter,     which allowed local users to gain privileges or cause a     denial of service (system crash) via a crafted     AGPIOC_UNBIND agp_ioctl ioctl call, a different     vulnerability than CVE-2011-1745. (CVE-2011-2022)

  - The do_task_stat function in fs/proc/array.c in the     Linux kernel did not perform an expected uid check,     which made it easier for local users to defeat the ASLR     protection mechanism by reading the start_code and     end_code fields in the /proc/#####/stat file for a     process executing a PIE binary. (CVE-2011-0726)

  - The normal mmap paths all avoid creating a mapping where     the pgoff inside the mapping could wrap around due to     overflow. However, an expanding mremap() can take such a     non-wrapping mapping and make it bigger and cause a     wrapping condition. (CVE-2011-2496)

  - A local unprivileged user able to access a NFS     filesystem could use file locking to deadlock parts of     an nfs server under some circumstance. (CVE-2011-2491)

  - The code for evaluating LDM partitions (in     fs/partitions/ldm.c) contained bugs that could crash the     kernel for certain corrupted LDM partitions.
    (CVE-2011-1017 / CVE-2011-2182)

  - When using a setuid root mount.cifs, local users could     hijack password protected mounted CIFS shares of other     local users. (CVE-2011-1585)

Also following non-security bugs were fixed :

  -     patches.suse/fs-proc-vmcorec-add-hook-to-read_from_oldme     m-to-check-for-non-ram-pages.patch: fs/proc/vmcore.c:
    add hook to read_from_oldmem() to check for non-ram     pages. (bnc#684297)

  - patches.xen/1062-xenbus-dev-leak.patch: xenbus: Fix     memory leak on release.

  - patches.xen/1074-xenbus_conn-type.patch: xenbus: fix     type inconsistency with xenbus_conn().

  - patches.xen/1080-blkfront-xenbus-gather-format.patch:
    blkfront: fix data size for xenbus_gather in connect().

  - patches.xen/1081-blkback-resize-transaction-end.patch:
    xenbus: fix xenbus_transaction_start() hang caused by     double xenbus_transaction_end().

  - patches.xen/1089-blkback-barrier-check.patch: blkback:
    dont fail empty barrier requests.

  - patches.xen/1091-xenbus-dev-no-BUG.patch: xenbus: dont     BUG() on user mode induced conditions. (bnc#696107)

  - patches.xen/1098-blkfront-cdrom-ioctl-check.patch:
    blkfront: avoid NULL de-reference in CDROM ioctl     handling. (bnc#701355)

  - patches.xen/1102-x86-max-contig-order.patch: x86: use     dynamically adjusted upper bound for contiguous regions.
    (bnc#635880)

  -     patches.xen/xen3-x86-sanitize-user-specified-e820-memmap
    -values.patch: x86: sanitize user specified e820 memmap     values. (bnc#665543)

  -     patches.fixes/libiscsi-dont-run-scsi-eh-if-iscsi-task-is
    -making-progress: Fix typo, which was uncovered in debug     mode.

  - patches.fixes/pacct-fix-sighand-siglock-usage.patch: Fix     sighand->siglock usage in kernel/acct.c. (bnc#705463)

This kernel update for the SUSE Linux Enterprise 10 SP4 kernel fixes several security issues and bugs.

The following security issues were fixed :

  - The dccp_rcv_state_process function in net/dccp/input.c     in the Datagram Congestion Control Protocol (DCCP)     implementation in the Linux kernel did not properly     handle packets for a CLOSED endpoint, which allowed     remote attackers to cause a denial of service (NULL     pointer dereference and OOPS) by sending a DCCP-Close     packet followed by a DCCP-Reset packet. (CVE-2011-1093)

  - The add_del_listener function in kernel/taskstats.c in     the Linux kernel did not prevent multiple registrations     of exit handlers, which allowed local users to cause a     denial of service (memory and CPU consumption), and     bypass the OOM Killer, via a crafted application.
    (CVE-2011-2484)

  - Integer overflow in the agp_generic_insert_memory     function in drivers/char/agp/generic.c in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (system crash) via a crafted     AGPIOC_BIND agp_ioctl ioctl call. (CVE-2011-1745)

  - Multiple integer overflows in the (1)     agp_allocate_memory and (2) agp_create_user_memory     functions in drivers/char/agp/generic.c in the Linux     kernel allowed local users to trigger buffer overflows,     and consequently cause a denial of service (system     crash) or possibly have unspecified other impact, via     vectors related to calls that specify a large number of     memory pages. (CVE-2011-1746)

  - The agp_generic_remove_memory function in     drivers/char/agp/generic.c in the Linux kernel before     2.6.38.5 did not validate a certain start parameter,     which allowed local users to gain privileges or cause a     denial of service (system crash) via a crafted     AGPIOC_UNBIND agp_ioctl ioctl call, a different     vulnerability than CVE-2011-1745. (CVE-2011-2022)

  - When using a setuid root mount.cifs, local users could     hijack password protected mounted CIFS shares of other     local users. (CVE-2011-1585)

  - The do_task_stat function in fs/proc/array.c in the     Linux kernel did not perform an expected uid check,     which made it easier for local users to defeat the ASLR     protection mechanism by reading the start_code and     end_code fields in the /proc/#####/stat file for a     process executing a PIE binary. (CVE-2011-0726)

  - The normal mmap paths all avoid creating a mapping where     the pgoff inside the mapping could wrap around due to     overflow. However, an expanding mremap() can take such a     non-wrapping mapping and make it bigger and cause a     wrapping condition. (CVE-2011-2496)

  - A local unprivileged user able to access a NFS     filesystem could use file locking to deadlock parts of     an nfs server under some circumstance. (CVE-2011-2491)

  - The code for evaluating LDM partitions (in     fs/partitions/ldm.c) contained bugs that could crash the     kernel for certain corrupted LDM partitions.
    (CVE-2011-1017 / CVE-2011-2182)

  - Multiple integer overflows in the next_pidmap function     in kernel/pid.c in the Linux kernel allowed local users     to cause a denial of service (system crash) via a     crafted (1) getdents or (2) readdir system call.
    (CVE-2011-1593)

  - Integer overflow in the _ctl_do_mpt_command function in     drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel     might have allowed local users to gain privileges or     cause a denial of service (memory corruption) via an     ioctl call specifying a crafted value that triggers a     heap-based buffer overflow. (CVE-2011-1494)

  - drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel     did not validate (1) length and (2) offset values before     performing memory copy operations, which might have     allowed local users to gain privileges, cause a denial     of service (memory corruption), or obtain sensitive     information from kernel memory via a crafted ioctl call,     related to the _ctl_do_mpt_command and
    _ctl_diag_read_buffer functions. (CVE-2011-1495)

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

Vegard Nossum discovered a leak in the kernel's inotify_init() system call. A local, unprivileged user could exploit this to cause a denial of service. (CVE-2010-4250)

An error was discovered in the kernel's handling of CUSE (Character device in Userspace). A local attacker might exploit this flaw to escalate privilege, if access to /dev/cuse has been modified to allow non-root users. (CVE-2010-4650)

A flaw was found in the kernel's Integrity Measurement Architecture (IMA). Changes made by an attacker might not be discovered by IMA, if SELinux was disabled, and a new IMA rule was loaded. (CVE-2011-0006)

A flaw was found in the Linux Ethernet bridge's handling of IGMP (Internet Group Management Protocol) packets. An unprivileged local user could exploit this flaw to crash the system. (CVE-2011-0716)

Dan Rosenberg reported errors in the OSS (Open Sound System) MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. (CVE-2011-1476)

Dan Rosenberg reported errors in the kernel's OSS (Open Sound System) driver for Yamaha FM synthesizer chips. A local user can exploit this to cause memory corruption, causing a denial of service or privilege escalation. (CVE-2011-1477)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

It was discovered that some import kernel threads can be blocked by a user level process. An unprivileged local user could exploit this flaw to cause a denial of service. (CVE-2011-4621)

A flaw was discovered in the XFS filesystem. If a local user mounts a specially crafted XFS image it could potential execute arbitrary code on the system. (CVE-2012-0038)

Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. (CVE-2012-0044)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges.

Dan Rosenberg reported errors in the OSS (Open Sound System) MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. (CVE-2011-1476)

Dan Rosenberg reported errors in the kernel's OSS (Open Sound System) driver for Yamaha FM synthesizer chips. A local user can exploit this to cause memory corruption, causing a denial of service or privilege escalation. (CVE-2011-1477)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

A flaw was discovered in the Linux kernel's NFSv4 (Network File System version 4) file system. A local, unprivileged user could use this flaw to cause a denial of service by creating a file in a NFSv4 filesystem.
(CVE-2011-4324)

A flaw was found in how the linux kernel handles user-space held futexs. An unprivileged user could exploit this flaw to cause a denial of service or possibly elevate privileges. (CVE-2012-0028).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's handling of IPv4 icmp packets. A remote user could exploit this to cause a denial of service. (CVE-2011-1927)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

The linux kernel did not properly account for PTE pages when deciding which task to kill in out of memory conditions. A local, unprivileged could exploit this flaw to cause a denial of service. (CVE-2011-2498)

A flaw was discovered in the TOMOYO LSM's handling of mount system calls. An unprivileged user could oops the system causing a denial of service. (CVE-2011-2518)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

Peter Huewe discovered an information leak in the handling of reading security-related TPM data. A local, unprivileged user could read the results of a previous TPM command. (CVE-2011-1162)

Dan Rosenberg reported an error in the old ABI compatibility layer of ARM kernels. A local attacker could exploit this flaw to cause a denial of service or gain root privileges. (CVE-2011-1759)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Clement Lecigne discovered a bug in the HFS filesystem. A local attacker could exploit this to cause a kernel oops. (CVE-2011-2203)

A flaw was found in how the Linux kernel handles user-defined key types. An unprivileged local user could exploit this to crash the system. (CVE-2011-4110).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities. (CVE-2011-1020)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-1078)

Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check that device name strings were NULL terminated. A local attacker could exploit this to crash the system, leading to a denial of service, or leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1079)

Vasiliy Kulikov discovered that bridge network filtering did not check that name fields were NULL terminated. A local attacker could exploit this to leak contents of kernel stack memory, leading to a loss of privacy. (CVE-2011-1080)

Johan Hovold discovered that the DCCP network stack did not correctly handle certain packet combinations. A remote attacker could send specially crafted network traffic that would crash the system, leading to a denial of service. (CVE-2011-1093)

Peter Huewe discovered that the TPM device did not correctly initialize memory. A local attacker could exploit this to read kernel heap memory contents, leading to a loss of privacy. (CVE-2011-1160)

Dan Rosenberg discovered that the IRDA subsystem did not correctly check certain field sizes. If a system was using IRDA, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-1180)

Ryan Sweat discovered that the GRO code did not correctly validate memory. In some configurations on systems using VLANs, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1478)

It was discovered that the security fix for CVE-2010-4250 introduced a regression. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-1479)

Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. (CVE-2011-1493)

It was discovered that the Stream Control Transmission Protocol (SCTP) implementation incorrectly calculated lengths. If the net.sctp.addip_enable variable was turned on, a remote attacker could send specially crafted traffic to crash the system. (CVE-2011-1573)

Ryan Sweat discovered that the kernel incorrectly handled certain VLAN packets. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

Phil Oester discovered that the network bonding system did not correctly handle large queues. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1581)

It was discovered that CIFS incorrectly handled authentication. When a user had a CIFS share mounted that required authentication, a local user could mount the same share without knowing the correct password.
(CVE-2011-1585)

It was discovered that the GRE protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ip_gre module was loading, and crash the system, leading to a denial of service. (CVE-2011-1767)

It was discovered that the IP/IP protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ipip module was loading, and crash the system, leading to a denial of service. (CVE-2011-1768)

Ben Greear discovered that CIFS did not correctly handle direct I/O. A local attacker with access to a CIFS partition could exploit this to crash the system, leading to a denial of service. (CVE-2011-1771)

Timo Warns discovered that the EFI GUID partition table was not correctly parsed. A physically local attacker that could insert mountable devices could exploit this to crash the system or possibly gain root privileges. (CVE-2011-1776)

Vasiliy Kulikov and Dan Rosenberg discovered that ecryptfs did not correctly check the origin of mount points. A local attacker could exploit this to trick the system into unmounting arbitrary mount points, leading to a denial of service. (CVE-2011-1833)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

It was discovered that an mmap() call with the MAP_PRIVATE flag on '/dev/zero' was incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-2479)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could exploit this to exhaust memory and CPU resources, leading to a denial of service. (CVE-2011-2484)

It was discovered that Bluetooth l2cap and rfcomm did not correctly initialize structures. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy.
(CVE-2011-2492)

Sami Liedes discovered that ext4 did not correctly handle missing root inodes. A local attacker could trigger the mount of a specially crafted filesystem to cause the system to crash, leading to a denial of service. (CVE-2011-2493)

Robert Swiecki discovered that mapping extensions were incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2496)

Dan Rosenberg discovered that the Bluetooth stack incorrectly handled certain L2CAP requests. If a system was using Bluetooth, a remote attacker could send specially crafted traffic to crash the system or gain root privileges. (CVE-2011-2497)

Ben Pfaff discovered that Classless Queuing Disciplines (qdiscs) were being incorrectly handled. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2525)

It was discovered that GFS2 did not correctly check block sizes. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2689)

It was discovered that the EXT4 filesystem contained multiple off-by-one flaws. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2695)

Fernando Gont discovered that the IPv6 stack used predictable fragment identification numbers. A remote attacker could exploit this to exhaust network resources, leading to a denial of service.
(CVE-2011-2699)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

Time Warns discovered that long symlinks were incorrectly handled on Be filesystems. A local attacker could exploit this with a malformed Be filesystem and crash the system, leading to a denial of service.
(CVE-2011-2928)

Qianfeng Zhang discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service.
(CVE-2011-2942)

Dan Kaminsky discovered that the kernel incorrectly handled random sequence number generation. An attacker could use this flaw to possibly predict sequence numbers and inject packets. (CVE-2011-3188)

Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user. (CVE-2011-3191)

Yasuaki Ishimatsu discovered a flaw in the kernel's clock implementation. A local unprivileged attacker could exploit this causing a denial of service. (CVE-2011-3209)

Yogesh Sharma discovered that CIFS did not correctly handle UNCs that had no prefixpaths. A local attacker with access to a CIFS partition could exploit this to crash the system, leading to a denial of service. (CVE-2011-3363)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

A flaw was found in the Linux kernel's /proc/*/*map* interface. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-3637)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-4087)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326)

Ben Hutchings discovered several flaws in the Linux Rose (X.25 PLP) layer. A local user or a remote user on an X.25 network could exploit these flaws to execute arbitrary code as root. (CVE-2011-4914).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4076, CVE-2010-4077)

Alex Shi and Eric Dumazet discovered that the network stack did not correctly handle packet backlogs. A remote attacker could exploit this by sending a large amount of network traffic to cause the system to run out of memory, leading to a denial of service. (CVE-2010-4251, CVE-2010-4805)

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities. (CVE-2011-1020)

Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. (CVE-2011-1493)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

It was discovered that CIFS incorrectly handled authentication. When a user had a CIFS share mounted that required authentication, a local user could mount the same share without knowing the correct password.
(CVE-2011-1585)

It was discovered that the GRE protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ip_gre module was loading, and crash the system, leading to a denial of service. (CVE-2011-1767)

It was discovered that the IP/IP protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ipip module was loading, and crash the system, leading to a denial of service. (CVE-2011-1768)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Andrea Righi discovered a race condition in the KSM memory merging support. If KSM was being used, a local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2183)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could exploit this to exhaust memory and CPU resources, leading to a denial of service. (CVE-2011-2484)

It was discovered that Bluetooth l2cap and rfcomm did not correctly initialize structures. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy.
(CVE-2011-2492)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Vasiliy Kulikov discovered that the Comedi driver did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-2909)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

A flaw was found in the Linux kernel's /proc/*/*map* interface. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-3637)

Ben Hutchings discovered several flaws in the Linux Rose (X.25 PLP) layer. A local user or a remote user on an X.25 network could exploit these flaws to execute arbitrary code as root. (CVE-2011-4914).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dan Rosenberg discovered that multiple terminal ioctls did not correctly initialize structure memory. A local attacker could exploit this to read portions of kernel stack memory, leading to a loss of privacy. (CVE-2010-4076, CVE-2010-4077)

Alex Shi and Eric Dumazet discovered that the network stack did not correctly handle packet backlogs. A remote attacker could exploit this by sending a large amount of network traffic to cause the system to run out of memory, leading to a denial of service. (CVE-2010-4251, CVE-2010-4805)

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities. (CVE-2011-1020)

Dan Rosenberg discovered that the X.25 Rose network stack did not correctly handle certain fields. If a system was running with Rose enabled, a remote attacker could send specially crafted traffic to gain root privileges. (CVE-2011-1493)

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

It was discovered that CIFS incorrectly handled authentication. When a user had a CIFS share mounted that required authentication, a local user could mount the same share without knowing the correct password.
(CVE-2011-1585)

It was discovered that the GRE protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ip_gre module was loading, and crash the system, leading to a denial of service. (CVE-2011-1767)

It was discovered that the IP/IP protocol incorrectly handled netns initialization. A remote attacker could send a packet while the ipip module was loading, and crash the system, leading to a denial of service. (CVE-2011-1768)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Andrea Righi discovered a race condition in the KSM memory merging support. If KSM was being used, a local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2183)

Dan Rosenberg discovered that the IPv4 diagnostic routines did not correctly validate certain requests. A local attacker could exploit this to consume CPU resources, leading to a denial of service.
(CVE-2011-2213)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could expoit this to exhaust memory and CPU resources, leading to a denial of service. (CVE-2011-2484)

It was discovered that Bluetooth l2cap and rfcomm did not correctly initialize structures. A local attacker could exploit this to read portions of the kernel stack, leading to a loss of privacy.
(CVE-2011-2492)

Mauro Carvalho Chehab discovered that the si4713 radio driver did not correctly check the length of memory copies. If this hardware was available, a local attacker could exploit this to crash the system or gain root privileges. (CVE-2011-2700)

Herbert Xu discovered that certain fields were incorrectly handled when Generic Receive Offload (CVE-2011-2723)

Vasiliy Kulikov discovered that the Comedi driver did not correctly clear memory. A local attacker could exploit this to read kernel stack memory, leading to a loss of privacy. (CVE-2011-2909)

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-2918)

A flaw was found in the Linux kernel's /proc/*/*map* interface. A local, unprivileged user could exploit this flaw to cause a denial of service. (CVE-2011-3637)

Ben Hutchings discovered several flaws in the Linux Rose (X.25 PLP) layer. A local user or a remote user on an X.25 network could exploit these flaws to execute arbitrary code as root. (CVE-2011-4914).

Timo Warns discovered that the GUID partition parsing routines did not correctly validate certain structures. A local attacker with physical access could plug in a specially crafted block device to crash the system, leading to a denial of service. (CVE-2011-1577)

Phil Oester discovered that the network bonding system did not correctly handle large queues. On some systems, a remote attacker could send specially crafted traffic to crash the system, leading to a denial of service. (CVE-2011-1581)

Ben Hutchings reported a flaw in the kernel's handling of corrupt LDM partitions. A local user could exploit this to cause a denial of service or escalate privileges. (CVE-2011-2182)

Vasiliy Kulikov discovered that taskstats listeners were not correctly handled. A local attacker could exploit this to exhaust memory and CPU resources, leading to a denial of service. (CVE-2011-2484)

Sami Liedes discovered that ext4 did not correctly handle missing root inodes. A local attacker could trigger the mount of a specially crafted filesystem to cause the system to crash, leading to a denial of service. (CVE-2011-2493)

A flaw was discovered in the Linux kernel's AppArmor security interface when invalid information was written to it. An unprivileged local user could use this to cause a denial of service on the system.
(CVE-2011-3619)

Scot Doyle discovered that the bridge networking interface incorrectly handled certain network packets. A remote attacker could exploit this to crash the system, leading to a denial of service. (CVE-2011-4087)

A bug was found in the way headroom check was performed in udp6_ufo_fragment() function. A remote attacker could use this flaw to crash the system. (CVE-2011-4326).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The SUSE Linux Enterprise 11 Service Pack 1 kernel was updated to 2.6.32.43 and fixes various bugs and security issues.

The following security issues were fixed :

  - The normal mmap paths all avoid creating a mapping where     the pgoff inside the mapping could wrap around due to     overflow. However, an expanding mremap() can take such a     non-wrapping mapping and make it bigger and cause a     wrapping condition. (CVE-2011-2496)

  - A local unprivileged user able to access a NFS     filesystem could use file locking to deadlock parts of     an nfs server under some circumstance. (CVE-2011-2491)

  - Fixed a race between ksmd and other memory management     code, which could result in a NULL ptr dereference and     kernel crash. (CVE-2011-2183)

  - In both trigger_scan and sched_scan operations, we were     checking for the SSID length before assigning the value     correctly. Since the memory was just kzalloced, the     check was always failing and SSID with over 32     characters were allowed to go through. This required     CAP_NET_ADMIN privileges to be exploited.
    (CVE-2011-2517)

  - A malicious user or buggy application could inject     diagnosing byte code and trigger an infinite loop in     inet_diag_bc_audit(). (CVE-2011-2213)

  - The code for evaluating LDM partitions (in     fs/partitions/ldm.c) contained bugs that could crash the     kernel for certain corrupted LDM partitions.
    (CVE-2011-1017 / CVE-2011-1012 / CVE-2011-2182)

  - Multiple integer overflows in the next_pidmap function     in kernel/pid.c in the Linux kernel allowed local users     to cause a denial of service (system crash) via a     crafted (1) getdents or (2) readdir system call.
    (CVE-2011-1593)

  - The proc filesystem implementation in the Linux kernel     did not restrict access to the /proc directory tree of a     process after this process performs an exec of a setuid     program, which allowed local users to obtain sensitive     information or cause a denial of service via open,     lseek, read, and write system calls. (CVE-2011-1020)

  - When using a setuid root mount.cifs, local users could     hijack password protected mounted CIFS shares of other     local users. (CVE-2011-1585)

  - Kernel information via the TPM devices could by used by     local attackers to read kernel memory. (CVE-2011-1160)

  - The Linux kernel automatically evaluated partition     tables of storage devices. The code for evaluating EFI     GUID partitions (in fs/partitions/efi.c) contained a bug     that causes a kernel oops on certain corrupted GUID     partition tables, which might be used by local attackers     to crash the kernel or potentially execute code.
    (CVE-2011-1577)

  - In a bluetooth ioctl, struct sco_conninfo has one     padding byte in the end. Local variable cinfo of type     sco_conninfo was copied to userspace with this     uninizialized one byte, leading to an old stack contents     leak. (CVE-2011-1078)

  - In a bluetooth ioctl, struct ca is copied from     userspace. It was not checked whether the 'device' field     was NULL terminated. This potentially leads to BUG()     inside of alloc_netdev_mqs() and/or information leak by     creating a device with a name made of contents of kernel     stack. (CVE-2011-1079)

  - In ebtables rule loading, struct tmp is copied from     userspace. It was not checked whether the 'name' field     is NULL terminated. This may have lead to buffer     overflow and passing contents of kernel stack as a     module name to try_then_request_module() and,     consequently, to modprobe commandline. It would be seen     by all userspace processes. (CVE-2011-1080)

  - The econet_sendmsg function in net/econet/af_econet.c in     the Linux kernel on the x86_64 platform allowed remote     attackers to obtain potentially sensitive information     from kernel stack memory by reading uninitialized data     in the ah field of an Acorn Universal Networking (AUN)     packet. (CVE-2011-1173)

  - net/ipv4/netfilter/arp_tables.c in the IPv4     implementation in the Linux kernel did not place the     expected '0' character at the end of string data in the     values of certain structure members, which allowed local     users to obtain potentially sensitive information from     kernel memory by leveraging the CAP_NET_ADMIN capability     to issue a crafted request, and then reading the     argument to the resulting modprobe process.
    (CVE-2011-1170)

  - net/ipv4/netfilter/ip_tables.c in the IPv4     implementation in the Linux kernel did not place the     expected '0' character at the end of string data in the     values of certain structure members, which allowed local     users to obtain potentially sensitive information from     kernel memory by leveraging the CAP_NET_ADMIN capability     to issue a crafted request, and then reading the     argument to the resulting modprobe process.
    (CVE-2011-1171)

  - net/ipv6/netfilter/ip6_tables.c in the IPv6     implementation in the Linux kernel did not place the     expected '0' character at the end of string data in the     values of certain structure members, which allowed local     users to obtain potentially sensitive information from     kernel memory by leveraging the CAP_NET_ADMIN capability     to issue a crafted request, and then reading the     argument to the resulting modprobe process.
    (CVE-2011-1172)

  - Multiple integer overflows in the (1)     agp_allocate_memory and (2) agp_create_user_memory     functions in drivers/char/agp/generic.c in the Linux     kernel before allowed local users to trigger buffer     overflows, and consequently cause a denial of service     (system crash) or possibly have unspecified other     impact, via vectors related to calls that specify a     large number of memory pages. (CVE-2011-1746)

  - Integer overflow in the agp_generic_insert_memory     function in drivers/char/agp/generic.c in the Linux     kernel allowed local users to gain privileges or cause a     denial of service (system crash) via a crafted     AGPIOC_BIND agp_ioctl ioctl call. (CVE-2011-1745)

  - The bcm_release function in net/can/bcm.c in the Linux     kernel did not properly validate a socket data     structure, which allowed local users to cause a denial     of service (NULL pointer dereference) or possibly have     unspecified other impact via a crafted release     operation. (CVE-2011-1598)

  - The raw_release function in net/can/raw.c in the Linux     kernel did not properly validate a socket data     structure, which allows local users to cause a denial of     service (NULL pointer dereference) or possibly have     unspecified other impact via a crafted release     operation. (CVE-2011-1748)

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-2524     David Howells reported an issue in the Common Internet     File System (CIFS). Local users could cause arbitrary     CIFS shares to be mounted by introducing malicious     redirects.

  - CVE-2010-3875     Vasiliy Kulikov discovered an issue in the Linux     implementation of the Amateur Radio AX.25 Level 2     protocol. Local users may obtain access to sensitive     kernel memory.

  - CVE-2010-4075     Dan Rosenberg reported an issue in the tty layer that     may allow local users to obtain access to sensitive     kernel memory.

  - CVE-2010-4655     Kees Cook discovered several issues in the ethtool     interface which may allow local users with the     CAP_NET_ADMIN capability to obtain access to sensitive     kernel memory.

  - CVE-2011-0695     Jens Kuehnel reported an issue in the InfiniBand stack.
    Remote attackers can exploit a race condition to cause a     denial of service (kernel panic).

  - CVE-2011-0710     Al Viro reported an issue in the /proc/<pid>/status     interface on the s390 architecture. Local users could     gain access to sensitive memory in processes they do not     own via the task_show_regs entry.

  - CVE-2011-0711     Dan Rosenberg reported an issue in the XFS filesystem.
    Local users may obtain access to sensitive kernel     memory.

  - CVE-2011-0726     Kees Cook reported an issue in the /proc/<pid>/stat     implementation. Local users could learn the text     location of a process, defeating protections provided by     address space layout randomization (ASLR).

  - CVE-2011-1010     Timo Warns reported an issue in the Linux support for     Mac partition tables. Local users with physical access     could cause a denial of service (panic) by adding a     storage device with a malicious map_count value.

  - CVE-2011-1012     Timo Warns reported an issue in the Linux support for     LDM partition tables. Local users with physical access     could cause a denial of service (Oops) by adding a     storage device with an invalid VBLK value in the VMDB     structure.

  - CVE-2011-1017     Timo Warns reported an issue in the Linux support for     LDM partition tables. Users with physical access can     gain access to sensitive kernel memory or gain elevated     privileges by adding a storage device with a specially     crafted LDM partition.

  - CVE-2011-1078     Vasiliy Kulikov discovered an issue in the Bluetooth     subsystem. Local users can obtain access to sensitive     kernel memory.

  - CVE-2011-1079     Vasiliy Kulikov discovered an issue in the Bluetooth     subsystem. Local users with the CAP_NET_ADMIN capability     can cause a denial of service (kernel Oops).

  - CVE-2011-1080     Vasiliy Kulikov discovered an issue in the Netfilter     subsystem. Local users can obtain access to sensitive     kernel memory.

  - CVE-2011-1090     Neil Horman discovered a memory leak in the setacl()     call on NFSv4 filesystems. Local users can exploit this     to cause a denial of service (Oops).

  - CVE-2011-1093     Johan Hovold reported an issue in the Datagram     Congestion Control Protocol (DCCP) implementation.
    Remote users could cause a denial of service by sending     data after closing a socket.

  - CVE-2011-1160     Peter Huewe reported an issue in the Linux kernel's     support for TPM security chips. Local users with     permission to open the device can gain access to     sensitive kernel memory.

  - CVE-2011-1163     Timo Warns reported an issue in the kernel support for     Alpha OSF format disk partitions. Users with physical     access can gain access to sensitive kernel memory by     adding a storage device with a specially crafted OSF     partition.

  - CVE-2011-1170     Vasiliy Kulikov reported an issue in the Netfilter arp     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1171     Vasiliy Kulikov reported an issue in the Netfilter IP     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1172     Vasiliy Kulikov reported an issue in the Netfilter IP6     table implementation. Local users with the CAP_NET_ADMIN     capability can gain access to sensitive kernel memory.

  - CVE-2011-1173     Vasiliy Kulikov reported an issue in the Acorn Econet     protocol implementation. Local users can obtain access     to sensitive kernel memory on systems that use this rare     hardware.

  - CVE-2011-1180     Dan Rosenberg reported a buffer overflow in the     Information Access Service of the IrDA protocol, used     for Infrared devices. Remote attackers within IR device     range can cause a denial of service or possibly gain     elevated privileges.

  - CVE-2011-1182     Julien Tinnes reported an issue in the rt_sigqueueinfo     interface. Local users can generate signals with     falsified source pid and uid information.

  - CVE-2011-1477     Dan Rosenberg reported issues in the Open Sound System     driver for cards that include a Yamaha FM synthesizer     chip. Local users can cause memory corruption resulting     in a denial of service. This issue does not affect     official Debian Linux image packages as they no longer     provide support for OSS. However, custom kernels built     from Debians linux-source-2.6.26 may have enabled this     configuration and would therefore be vulnerable.

  - CVE-2011-1493     Dan Rosenburg reported two issues in the Linux     implementation of the Amateur Radio X.25 PLP (Rose)     protocol. A remote user can cause a denial of service by     providing specially crafted facilities fields.

  - CVE-2011-1577     Timo Warns reported an issue in the Linux support for     GPT partition tables. Local users with physical access     could cause a denial of service (Oops) by adding a     storage device with a malicious partition table header.

  - CVE-2011-1593     Robert Swiecki reported a signednes issue in the     next_pidmap() function, which can be exploited my local     users to cause a denial of service.

  - CVE-2011-1598     Dave Jones reported an issue in the Broadcast Manager     Controller Area Network (CAN/BCM) protocol that may     allow local users to cause a NULL pointer dereference,     resulting in a denial of service.

  - CVE-2011-1745     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the AGPIOC_BIND ioctl. On default     Debian installations, this is exploitable only by users     in the video group.

  - CVE-2011-1746     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the agp_allocate_memory and     agp_create_user_memory. On default Debian installations,     this is exploitable only by users in the video group.

  - CVE-2011-1748     Oliver Kartkopp reported an issue in the Controller Area     Network (CAN) raw socket implementation which permits     ocal users to cause a NULL pointer dereference,     resulting in a denial of service.

  - CVE-2011-1759     Dan Rosenberg reported an issue in the support for     executing 'old ABI' binaries on ARM processors. Local     users can obtain elevated privileges due to insufficient     bounds checking in the semtimedop system call.

  - CVE-2011-1767     Alexecy Dobriyan reported an issue in the GRE over IP     implementation. Remote users can cause a denial of     service by sending a packet during module     initialization.

  - CVE-2011-1768     Alexecy Dobriyan reported an issue in the IP tunnels     implementation. Remote users can cause a denial of     service by sending a packet during module     initialization.

  - CVE-2011-1776     Timo Warns reported an issue in the Linux implementation     for GUID partitions. Users with physical access can gain     access to sensitive kernel memory by adding a storage     device with a specially crafted corrupted invalid     partition table.

  - CVE-2011-2022     Vasiliy Kulikov reported an issue in the Linux support     for AGP devices. Local users can obtain elevated     privileges or cause a denial of service due to missing     bounds checking in the AGPIOC_UNBIND ioctl. On default     Debian installations, this is exploitable only by users     in the video group.

  - CVE-2011-2182     Ben Hutchings reported an issue with the fix for     CVE-2011-1017 (see above) that made it insufficient to     resolve the issue.

ID	Name	Product	Family	Severity
75880	openSUSE Security Update : kernel (openSUSE-SU-2011:0860-1)	Nessus	SuSE Local Security Checks	high
75555	openSUSE Security Update : kernel (openSUSE-SU-2011:0861-1)	Nessus	SuSE Local Security Checks	high
68425	Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2011-2037)	Nessus	Oracle Linux Local Security Checks	high
59159	SuSE 10 Security Update : the Linux kernel (ZYPP Patch Number 7729)	Nessus	SuSE Local Security Checks	critical
59158	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7665)	Nessus	SuSE Local Security Checks	high
58289	USN-1394-1 : Linux kernel (OMAP4) vulnerabilities	Nessus	Ubuntu Local Security Checks	high
58288	USN-1392-1 : linux-fsl-imx51 vulnerability	Nessus	Ubuntu Local Security Checks	high
58271	Ubuntu 8.04 LTS : linux vulnerabilities (USN-1390-1)	Nessus	Ubuntu Local Security Checks	high
58264	USN-1383-1 : linux-ti-omap4 vulnerabilities	Nessus	Ubuntu Local Security Checks	high
57665	Ubuntu 10.10 : linux vulnerabilities (USN-1341-1)	Nessus	Ubuntu Local Security Checks	high
57535	Ubuntu 10.04 LTS : linux-lts-backport-maverick vulnerabilities (USN-1332-1)	Nessus	Ubuntu Local Security Checks	high
57213	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7666)	Nessus	SuSE Local Security Checks	high
56768	Ubuntu 10.04 LTS : linux-lts-backport-natty vulnerabilities (USN-1256-1)	Nessus	Ubuntu Local Security Checks	critical
56607	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 7734)	Nessus	SuSE Local Security Checks	critical
56343	Ubuntu 10.04 LTS : linux vulnerabilities (USN-1218-1)	Nessus	Ubuntu Local Security Checks	high
56305	Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-1216-1)	Nessus	Ubuntu Local Security Checks	high
56207	Ubuntu 10.10 : linux-mvl-dove vulnerabilities (USN-1208-1)	Nessus	Ubuntu Local Security Checks	high
56191	Ubuntu 10.04 LTS : linux-mvl-dove vulnerabilities (USN-1203-1)	Nessus	Ubuntu Local Security Checks	high
55923	Ubuntu 11.04 : linux vulnerabilities (USN-1193-1)	Nessus	Ubuntu Local Security Checks	high
55686	SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 4884 / 4888 / 4889)	Nessus	SuSE Local Security Checks	high
55170	Debian DSA-2264-1 : linux-2.6 - privilege escalation/denial of service/information leak	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2011-2182

high

Tenable Plugins

high

high

high

critical

high

high

high

high

high

high

high

high

critical

critical

high

high

high

high

high

high

high