CVE-2011-1495

Published: 3 May 2011

drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.

From the Ubuntu Security Team

Dan Rosenberg discovered that MPT devices did not correctly validate certain values in ioctl calls. If these drivers were loaded, a local attacker could exploit this to read arbitrary kernel memory, leading to a loss of privacy.

Status

References

• https://patchwork.kernel.org/patch/688021/
• http://openwall.com/lists/oss-security/2011/04/05/32
• https://ubuntu.com/security/notices/USN-1160-1
• https://ubuntu.com/security/notices/USN-1162-1
• https://ubuntu.com/security/notices/USN-1164-1
• https://ubuntu.com/security/notices/USN-1167-1
• https://ubuntu.com/security/notices/USN-1161-1
• https://ubuntu.com/security/notices/USN-1159-1
• https://ubuntu.com/security/notices/USN-1168-1
• https://ubuntu.com/security/notices/USN-1187-1
• https://ubuntu.com/security/notices/USN-1202-1
• https://ubuntu.com/security/notices/USN-1212-1
• https://www.cve.org/CVERecord?id=CVE-2011-1495
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=694021