Vulnerability Description
fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 2.6.38 |
Related Weaknesses (CWE)
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=
- http://openwall.com/lists/oss-security/2011/03/02/1Mailing ListPatchThird Party Advisory
- http://openwall.com/lists/oss-security/2011/03/02/2Mailing ListPatchThird Party Advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=681575Issue TrackingPatchThird Party Advisory
- https://lkml.org/lkml/2011/2/5/220Mailing ListPatchThird Party Advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=
- http://openwall.com/lists/oss-security/2011/03/02/1Mailing ListPatchThird Party Advisory
- http://openwall.com/lists/oss-security/2011/03/02/2Mailing ListPatchThird Party Advisory
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=681575Issue TrackingPatchThird Party Advisory
- https://lkml.org/lkml/2011/2/5/220Mailing ListPatchThird Party Advisory
FAQ
What is CVE-2011-1082?
CVE-2011-1082 is a vulnerability with a CVSS score of 4.9 (MEDIUM). fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local ...
How severe is CVE-2011-1082?
CVE-2011-1082 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2011-1082?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.