SB2012051703 - Multiple vulnerabilities in Linux kernel

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012051703

SB2012051703 - Multiple vulnerabilities in Linux kernel

Published: May 17, 2012 Updated: August 11, 2020

Security Bulletin ID SB2012051703
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2012-1090)

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

The cifs_lookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service (OOPS) via attempted access to a special file, as demonstrated by a FIFO.


2) NULL pointer dereference (CVE-ID: CVE-2012-1097)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call.


3) NULL pointer dereference (CVE-ID: CVE-2012-1146)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in mm/memcontrol.c in the Linux kernel before 3.2.10 does not properly handle multiple events that are attached to the same eventfd, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by registering memory threshold events. A remote attacker can perform a denial of service (DoS) attack.


Remediation

Install update from vendor's website.

References