CVE-2011-3191
Published: 25 August 2011
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.
From the Ubuntu security team
Darren Lavender discovered that the CIFS client incorrectly handled certain large values. A remote attacker with a malicious server could exploit this to crash the system or possibly execute arbitrary code as the root user.
Priority
Medium
CVSS 3 base score: 8.8
Status
| Package | Release | Status |
|---|---|---|
|
linux Launchpad, Ubuntu, Debian |
hardy |
Released
(2.6.24-29.94)
|
| lucid |
Released
(2.6.32-35.78)
|
|
| maverick |
Released
(2.6.35-30.60)
|
|
| natty |
Released
(2.6.38-12.51)
|
|
| oneiric |
Not vulnerable
(3.0.0-11.18)
|
|
| upstream |
Released
(3.1~rc7)
|
|
|
Patches: Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 |
||
|
linux-ec2 Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Released
(2.6.32-319.39)
|
|
| maverick |
Ignored
(binary supplied by "linux" now)
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(3.1~rc7)
|
|
|
linux-fsl-imx51 Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Released
(2.6.31-611.29)
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(3.1~rc7)
|
|
|
linux-lts-backport-maverick Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Released
(2.6.35-30.60~lucid1)
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(3.1~rc7)
|
|
|
linux-lts-backport-natty Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Released
(2.6.38-12.51~lucid1)
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(3.1~rc7)
|
|
|
linux-lts-backport-oneiric Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Not vulnerable
|
|
| maverick |
Does not exist
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(3.1~rc7)
|
|
|
linux-mvl-dove Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Released
(2.6.32-219.37)
|
|
| maverick |
Released
(2.6.32-419.37)
|
|
| natty |
Does not exist
|
|
| oneiric |
Does not exist
|
|
| upstream |
Released
(3.1~rc7)
|
|
|
linux-ti-omap4 Launchpad, Ubuntu, Debian |
hardy |
Does not exist
|
| lucid |
Does not exist
|
|
| maverick |
Released
(2.6.35-903.25)
|
|
| natty |
Released
(2.6.38-1209.16)
|
|
| oneiric |
Not vulnerable
(3.0.0-1205.10)
|
|
| upstream |
Released
(3.1~rc7)
|
|
Notes
| Author | Note |
|---|---|
| apw | patch title is as below in CIFS tree, likely SHA1 added below: cifs: fix possible memory corruption in CIFSFindNext |
| kees | actual sha is below, old one from CIFS tree was c32dfffaf59f73bbcf4472141b851a4dc5db2bf0 |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3191
- http://www.openwall.com/lists/oss-security/2011/08/24/2
- https://ubuntu.com/security/notices/USN-1220-1
- https://ubuntu.com/security/notices/USN-1219-1
- https://ubuntu.com/security/notices/USN-1225-1
- https://ubuntu.com/security/notices/USN-1227-1
- https://ubuntu.com/security/notices/USN-1228-1
- https://ubuntu.com/security/notices/USN-1239-1
- https://ubuntu.com/security/notices/USN-1246-1
- https://ubuntu.com/security/notices/USN-1245-1
- https://ubuntu.com/security/notices/USN-1241-1
- https://ubuntu.com/security/notices/USN-1240-1
- https://ubuntu.com/security/notices/USN-1253-1
- https://ubuntu.com/security/notices/USN-1256-1
- NVD
- Launchpad
- Debian