CVE-2011-2918

Published: 25 August 2011

The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CLOCK events, which allows local users to cause a denial of service (system hang) via a crafted application.

From the Ubuntu Security Team

The performance counter subsystem did not correctly handle certain counters. A local attacker could exploit this to crash the system, leading to a denial of service.

Notes

Author	Note
jdstrand	https://lkml.org/lkml/2011/7/27/337 (reproducer) https://lkml.org/lkml/2011/7/28/284 (fix)
apw	mainline fix: a8b0ca17b80e92faab46ee7179ba9e99ccb61233 stable fix: 462fee3af72df0de7b60b96c525ffe8baf4db0f0 http://git.kernel.org/?p=linux/kernel/git/stable/linux-3.0.y.git;a=commit;h=462fee3af72df0de7b60b96c525ffe8baf4db0f0

Author

Note

jdstrand

https://lkml.org/lkml/2011/7/27/337 (reproducer)
https://lkml.org/lkml/2011/7/28/284 (fix)

apw

mainline fix: a8b0ca17b80e92faab46ee7179ba9e99ccb61233
stable fix: 462fee3af72df0de7b60b96c525ffe8baf4db0f0
http://git.kernel.org/?p=linux/kernel/git/stable/linux-3.0.y.git;a=commit;h=462fee3af72df0de7b60b96c525ffe8baf4db0f0

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	hardy	Not vulnerable
	lucid	Released (2.6.32-34.73)
	maverick	Released (2.6.35-30.60)
	natty	Released (2.6.38-11.49)
	oneiric	Not vulnerable (3.0.0-8.10)
	upstream	Released (3.1~rc1)
	Patches: Introduced by 0793a61d4df8daeac6492dbf8d2f3e5713caae5e Fixed by a8b0ca17b80e92faab46ee7179ba9e99ccb61233
linux-ec2 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (2.6.32-318.37)
	maverick	Ignored (binary supplied by "linux" now)
	natty	Does not exist
	oneiric	Does not exist
	upstream	Released (3.1~rc1)
linux-fsl-imx51 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (2.6.31-610.28)
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	upstream	Released (3.1~rc1)
linux-lts-backport-maverick Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (2.6.35-30.60~lucid1)
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	upstream	Released (3.1~rc1)
linux-lts-backport-natty Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (2.6.38-11.49~lucid1)
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	upstream	Released (3.1~rc1)
linux-lts-backport-oneiric Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Not vulnerable
	maverick	Does not exist
	natty	Does not exist
	oneiric	Does not exist
	upstream	Released (3.1~rc1)
linux-mvl-dove Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Released (2.6.32-218.35)
	maverick	Released (2.6.32-418.35)
	natty	Does not exist
	oneiric	Does not exist
	upstream	Released (3.1~rc1)
linux-ti-omap4 Launchpad, Ubuntu, Debian	hardy	Does not exist
	lucid	Does not exist
	maverick	Released (2.6.35-903.24)
	natty	Released (2.6.38-1209.15)
	oneiric	Not vulnerable (3.0.0-1201.4)
	upstream	Released (3.1~rc1)

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›