CVE-2011-2517
published 2012-05-24CVE-2011-2517: Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN…
PriorityP427high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.38%
30.4th percentile
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | < 2.6.39.2 | 2.6.39.2 |
| linux | linux_kernel | >= 0 < 3.11.0-12.19 | 3.11.0-12.19 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7m92-7xrw-x2p7: Multiple buffer overflows in net/wireless/nl80211
ghsa_unreviewed·2022-05-13
CVE-2011-2517 [HIGH] CWE-119 GHSA-7m92-7xrw-x2p7: Multiple buffer overflows in net/wireless/nl80211
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
OSV
CVE-2011-2517: Multiple buffer overflows in net/wireless/nl80211
osv·2011-10-06·CVSS 7.2
CVE-2011-2517 [HIGH] CVE-2011-2517: Multiple buffer overflows in net/wireless/nl80211
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-12-03·CVSS 4.9
CVE-2011-2491 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Robert Swiecki discovered that mapping extensions were incorrectly handled.
A local attacker could exploit this to crash the system, leading to a
denial of service. (CVE-2011-2496)
It was discovered that the wireless stack incorrectly verified SSID
lengths. A local attacker could exploit this to cause a denial of service
or gain root privileges. (CVE-2011-2517)
Ben Pfaff discovered that Classless Queuing Disciplines (qdiscs) were being
incorrectly handled. A local attacker could exploit this to crash the
system, leadin
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-11-29·CVSS 4.0
CVE-2011-2183 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploit this to read certain
information, leading to a loss of privacy. (CVE-2011-2494)
Vasiliy Kulikov discovered that /proc/PID/io did not enforce access
restrictions. A local attacker could exploit this to read cert
Ubuntu
Linux (Maverick backport) vulnerabilities
vendor_ubuntu·2011-11-24·CVSS 3.3
CVE-2011-1585 [LOW] Linux (Maverick backport) vulnerabilities
Title: Linux (Maverick backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that CIFS incorrectly handled authentication. When a user
had a CIFS share mounted that required authentication, a local user could
mount the same share without knowing the correct password. (CVE-2011-1585)
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Robert Swiecki discovered that mapping extensions were incorrectly handled.
A loca
Ubuntu
Linux (Natty backport) vulnerabilities
vendor_ubuntu·2011-11-24·CVSS 4.0
CVE-2011-2183 [MEDIUM] Linux (Natty backport) vulnerabilities
Title: Linux (Natty backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploit this to read certain
information, leading to a loss of privacy. (CVE-2011-2494)
Vasiliy Kulikov discovered that /proc/PID/io did not enforce access
restrictions. A local attacker could exploit this to
Ubuntu
Linux (OMAP4) vulnerabilities
vendor_ubuntu·2011-11-24·CVSS 4.0
CVE-2011-2479 [MEDIUM] Linux (OMAP4) vulnerabilities
Title: Linux (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
It was discovered that an mmap() call with the MAP_PRIVATE flag on
"/dev/zero" was incorrectly handled. A local attacker could exploit this to
crash the system, leading to a denial of service. (CVE-2011-2479)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploit
Ubuntu
Linux kernel (Marvell DOVE) vulnerabilities
vendor_ubuntu·2011-11-21·CVSS 4.9
CVE-2011-2491 [MEDIUM] Linux kernel (Marvell DOVE) vulnerabilities
Title: Linux kernel (Marvell DOVE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Robert Swiecki discovered that mapping extensions were incorrectly handled.
A local attacker could exploit this to crash the system, leading to a
denial of service. (CVE-2011-2496)
It was discovered that the wireless stack incorrectly verified SSID
lengths. A local attacker could exploit this to cause a denial of service
or gain root privileges. (CVE-2011-2517)
Ben Pfaff discovered that Classless Queuing Disciplines (qdiscs) were being
incorrectly handled. A local attacker could exploit this to crash the
Ubuntu
Linux kernel (EC2) vulnerabilities
vendor_ubuntu·2011-11-21·CVSS 4.9
CVE-2011-2525 [MEDIUM] Linux kernel (EC2) vulnerabilities
Title: Linux kernel (EC2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Robert Swiecki discovered that mapping extensions were incorrectly handled.
A local attacker could exploit this to crash the system, leading to a
denial of service. (CVE-2011-2496)
It was discovered that the wireless stack incorrectly verified SSID
lengths. A local attacker could exploit this to cause a denial of service
or gain root privileges. (CVE-2011-2517)
Ben Pfaff discovered that Classless Queuing Disciplines (qdiscs) were being
incorrectly handled. A local attacker could exploit this to crash the
system,
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-11-21·CVSS 3.3
CVE-2011-1585 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that CIFS incorrectly handled authentication. When a user
had a CIFS share mounted that required authentication, a local user could
mount the same share without knowing the correct password. (CVE-2011-1585)
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Robert Swiecki discovered that mapping extensions were incorrectly handled.
A local attacker co
Ubuntu
Linux kernel (i.MX51) vulnerabilities
vendor_ubuntu·2011-10-25·CVSS 5.9
CVE-2011-1573 [MEDIUM] Linux kernel (i.MX51) vulnerabilities
Title: Linux kernel (i.MX51) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the Stream Control Transmission Protocol (SCTP)
implementation incorrectly calculated lengths. If the net.sctp.addip_enable
variable was turned on, a remote attacker could send specially crafted
traffic to crash the system. (CVE-2011-1573)
Ryan Sweat discovered that the kernel incorrectly handled certain VLAN
packets. On some systems, a remote attacker could send specially crafted
traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)
Timo Warns discovered that the EFI GUID partition table was not correctly
parsed. A physically local attacker that could insert mountable devices
could exploit this to crash the system or possibly gain root p
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-10-25·CVSS 5.0
CVE-2010-3873 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploi
Red Hat
kernel: nl80211: missing check for valid SSID size in scan operations
vendor_redhat·2011-05-18·CVSS 7.2
CVE-2011-2517 [HIGH] kernel: nl80211: missing check for valid SSID size in scan operations
kernel: nl80211: missing check for valid SSID size in scan operations
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 as it did not provide support for the Linux wireless LAN (802.11) configuration API. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-1212.html, https://rhn.redhat.com/errata/RHSA-2011-1189.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html.
Package: kernel (Red Hat Enterprise Linux 4) - Not affected
Package: ker
No detection rules found.
No public exploits indexed.
http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.2http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=208c72f4fe44fe09577e7975ba0e7fa0278f3d03http://rhn.redhat.com/errata/RHSA-2011-1212.htmlhttp://www.openwall.com/lists/oss-security/2011/07/01/4https://bugzilla.redhat.com/show_bug.cgi?id=718152https://github.com/torvalds/linux/commit/208c72f4fe44fe09577e7975ba0e7fa0278f3d03http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39.2http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=208c72f4fe44fe09577e7975ba0e7fa0278f3d03http://rhn.redhat.com/errata/RHSA-2011-1212.htmlhttp://www.openwall.com/lists/oss-security/2011/07/01/4https://bugzilla.redhat.com/show_bug.cgi?id=718152https://github.com/torvalds/linux/commit/208c72f4fe44fe09577e7975ba0e7fa0278f3d03
2012-05-24
Published