Information disclosure in Linux kernel - CVE-2011-1173
Published: June 23, 2011 / Updated: August 11, 2020
Vulnerability identifier: #VU44932
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2011-1173
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet.
How to mitigate CVE-2011-1173
Install update from vendor's website.
Sources
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=67c5c6cb8129c595f21e88254a3fc6b3b841ae8e
- http://marc.info/?l=linux-netdev&m=130036203528021&w=2
- http://securityreason.com/securityalert/8279
- http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39
- http://www.openwall.com/lists/oss-security/2011/03/18/15
- http://www.openwall.com/lists/oss-security/2011/03/21/1
- http://www.openwall.com/lists/oss-security/2011/03/21/4
- https://bugzilla.redhat.com/show_bug.cgi?id=591815#c14