CVE-2011-3363 — Improper Input Validation in Kernel

CWE-20 — Improper Input Validation15 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 68.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Linux KernelRedhat Enterprise Linux
Timeline
PublishedMay 24
Latest updateMay 13

Description

The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶NVDlinux/linux_kernel< 2.6.39

Also affects: Enterprise Linux 4.0

Patches

Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-3mjr-5fr9-2r8m: The setup_cifs_sb function in fs/cifs/connect↗2022-05-13
▶

📋Vendor Advisories

11
Ubuntu
Linux (OMAP4) vulnerabilities↗2011-11-24
▶
Ubuntu
Linux kernel (Natty backport) vulnerabilities↗2011-11-09
▶
Ubuntu
Linux kernel (Maverick backport) vulnerabilities↗2011-10-25
▶
Ubuntu
Linux kernel vulnerabilities↗2011-10-25
▶
Ubuntu
Linux kernel (i.MX51) vulnerabilities↗2011-10-25
▶

💬Community

2
Bugzilla
CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount [fedora-all]↗2011-10-25
▶
Bugzilla
CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount↗2011-09-14
▶