CVE-2011-3363
published 2012-05-24CVE-2011-3363: The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to…
PriorityP422medium6.5CVSS 3.1
AVAACLPRNUINSUCNINAH
EPSS
0.84%
53.7th percentile
The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | < 2.6.39 | 2.6.39 |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.06.1MEDIUMAV:A/AC:L/Au:N/C:N/I:N/A:C
vendor_ubuntu7.2HIGH
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux (OMAP4) vulnerabilities
vendor_ubuntu·2011-11-24·CVSS 4.0
CVE-2011-2479 [MEDIUM] Linux (OMAP4) vulnerabilities
Title: Linux (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
It was discovered that an mmap() call with the MAP_PRIVATE flag on
"/dev/zero" was incorrectly handled. A local attacker could exploit this to
crash the system, leading to a denial of service. (CVE-2011-2479)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploit
Ubuntu
Linux kernel (Natty backport) vulnerabilities
vendor_ubuntu·2011-11-09·CVSS 4.6
CVE-2011-1020 [MEDIUM] Linux kernel (Natty backport) vulnerabilities
Title: Linux kernel (Natty backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the /proc filesystem did not correctly handle
permission changes when programs executed. A local attacker could hold open
files to examine details about programs running with higher privileges,
potentially increasing the chances of exploiting additional
vulnerabilities. (CVE-2011-1020)
Vasiliy Kulikov discovered that the Bluetooth stack did not correctly clear
memory. A local attacker could exploit this to read kernel stack memory,
leading to a loss of privacy. (CVE-2011-1078)
Vasiliy Kulikov discovered that the Bluetooth stack did not correctly check
that device name strings were NULL terminated. A local attacker could
exploit this to crash the system,
Ubuntu
Linux kernel (Maverick backport) vulnerabilities
vendor_ubuntu·2011-10-25·CVSS 4.9
CVE-2011-1479 [MEDIUM] Linux kernel (Maverick backport) vulnerabilities
Title: Linux kernel (Maverick backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the security fix for CVE-2010-4250 introduced a
regression. A remote attacker could exploit this to crash the system,
leading to a denial of service. (CVE-2011-1479)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploit this to read certain
information, leading to a loss of privacy. (CVE-2011-2494)
Vasiliy Kulikov discovered that /proc/PID/io did not enforce access
restrictions. A local attacker could exploit this to read certain
information, leading to a loss of privacy. (CVE-2011-2495)
It was discovered that the EXT4 filesystem contained multiple off-by-one
flaws. A local attacker could explo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-10-25·CVSS 4.9
CVE-2011-1479 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the security fix for CVE-2010-4250 introduced a
regression. A remote attacker could exploit this to crash the system,
leading to a denial of service. (CVE-2011-1479)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploit this to read certain
information, leading to a loss of privacy. (CVE-2011-2494)
Vasiliy Kulikov discovered that /proc/PID/io did not enforce access
restrictions. A local attacker could exploit this to read certain
information, leading to a loss of privacy. (CVE-2011-2495)
It was discovered that the EXT4 filesystem contained multiple off-by-one
flaws. A local attacker could exploit this to crash the
Ubuntu
Linux kernel (i.MX51) vulnerabilities
vendor_ubuntu·2011-10-25·CVSS 5.9
CVE-2011-1573 [MEDIUM] Linux kernel (i.MX51) vulnerabilities
Title: Linux kernel (i.MX51) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that the Stream Control Transmission Protocol (SCTP)
implementation incorrectly calculated lengths. If the net.sctp.addip_enable
variable was turned on, a remote attacker could send specially crafted
traffic to crash the system. (CVE-2011-1573)
Ryan Sweat discovered that the kernel incorrectly handled certain VLAN
packets. On some systems, a remote attacker could send specially crafted
traffic to crash the system, leading to a denial of service.
(CVE-2011-1576)
Timo Warns discovered that the EFI GUID partition table was not correctly
parsed. A physically local attacker that could insert mountable devices
could exploit this to crash the system or possibly gain root p
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2011-10-25·CVSS 5.0
CVE-2010-3873 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Dan Rosenberg discovered that the Linux kernel X.25 implementation
incorrectly parsed facilities. A remote attacker could exploit this to
crash the kernel, leading to a denial of service. (CVE-2010-3873)
Andrea Righi discovered a race condition in the KSM memory merging support.
If KSM was being used, a local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2011-2183)
Vasily Averin discovered that the NFS Lock Manager (NLM) incorrectly
handled unlock requests. A local attacker could exploit this to cause a
denial of service. (CVE-2011-2491)
Vasiliy Kulikov discovered that taskstats did not enforce access
restrictions. A local attacker could exploi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-07-15·CVSS 7.2
CVE-2011-1017 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws have been fixed.
Timo Warns discovered that the LDM disk partition handling code did not
correctly handle certain values. By inserting a specially crafted disk
device, a local attacker could exploit this to gain root privileges.
(CVE-2011-1017)
Neil Horman discovered that NFSv4 did not correctly handle certain orders
of operation with ACL data. A remote attacker with access to an NFSv4 mount
could exploit this to crash the system, leading to a denial of service.
(CVE-2011-1090)
Timo Warns discovered that OSF partition parsing routines did not correctly
clear memory. A local attacker with physical access could plug in a
specially crafted block device to read kernel memory, leading to a loss of
privacy. (CVE-2011-1163)
D
Ubuntu
Linux kernel vulnerabilities (Marvell Dove)
vendor_ubuntu·2011-07-13·CVSS 4.9
CVE-2010-4243 [MEDIUM] Linux kernel vulnerabilities (Marvell Dove)
Title: Linux kernel vulnerabilities (Marvell Dove)
Summary: Multiple kernel flaws have been fixed.
Brad Spengler discovered that the kernel did not correctly account for
userspace memory allocations during exec() calls. A local attacker could
exploit this to consume all system memory, leading to a denial of service.
(CVE-2010-4243)
Alexander Duyck discovered that the Intel Gigabit Ethernet driver did not
correctly handle certain configurations. If such a device was configured
without VLANs, a remote attacker could crash the system, leading to a
denial of service. (CVE-2010-4263)
Nelson Elhage discovered that Econet did not correctly handle AUN packets
over UDP. A local attacker could send specially crafted traffic to crash
the system, leading to a denial of service. (CVE-2010-4342)
Da
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2011-07-13·CVSS 2.1
CVE-2011-1771 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple kernel flaws have been fixed.
Aristide Fattori and Roberto Paleari reported a flaw in the Linux kernel's
handling of IPv4 icmp packets. A remote user could exploit this to cause a
denial of service. (CVE-2011-1927)
Goldwyn Rodrigues discovered that the OCFS2 filesystem did not correctly
clear memory when writing certain file holes. A local attacker could
exploit this to read uninitialized data from the disk, leading to a loss of
privacy. (CVE-2011-0463)
Timo Warns discovered that the LDM disk partition handling code did not
correctly handle certain values. By inserting a specially crafted disk
device, a local attacker could exploit this to gain root privileges.
(CVE-2011-1017)
Vasiliy Kulikov discovered that the Bluetooth stack did
Ubuntu
Linux kernel vulnerabilities (EC2)
vendor_ubuntu·2011-07-13·CVSS 2.1
CVE-2010-3881 [LOW] Linux kernel vulnerabilities (EC2)
Title: Linux kernel vulnerabilities (EC2)
Summary: Multiple kernel flaws have been fixed.
Vasiliy Kulikov discovered that kvm did not correctly clear memory. A local
attacker could exploit this to read portions of the kernel stack, leading
to a loss of privacy. (CVE-2010-3881)
Timo Warns discovered that the LDM disk partition handling code did not
correctly handle certain values. By inserting a specially crafted disk
device, a local attacker could exploit this to gain root privileges.
(CVE-2011-1017)
Neil Horman discovered that NFSv4 did not correctly handle certain orders
of operation with ACL data. A remote attacker with access to an NFSv4 mount
could exploit this to crash the system, leading to a denial of service.
(CVE-2011-1090)
Timo Warns discovered that OSF partition parsing ro
Red Hat
kernel: cifs: always do is_path_accessible check in cifs_mount
vendor_redhat·2011-03-07·CVSS 6.5
CVE-2011-3363 [MEDIUM] kernel: cifs: always do is_path_accessible check in cifs_mount
kernel: cifs: always do is_path_accessible check in cifs_mount
The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
Statement: This issue affects the Linux kernel as shipped with Red Hat Enterprise Linux 4,
5, 6, and Red Hat Enterprise MRG. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates. This has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-14
GHSA
GHSA-3mjr-5fr9-2r8m: The setup_cifs_sb function in fs/cifs/connect
ghsa_unreviewed·2022-05-13
CVE-2011-3363 [MEDIUM] CWE-20 GHSA-3mjr-5fr9-2r8m: The setup_cifs_sb function in fs/cifs/connect
The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remote CIFS servers to cause a denial of service (system crash) by placing a referral at the root of a share.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount [fedora-all]
bugzilla·2011-10-25·CVSS 6.5
CVE-2011-3363 [MEDIUM] CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount [fedora-all]
CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=738291
Please note: this issue a
Bugzilla
CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount
bugzilla·2011-09-14·CVSS 6.5
CVE-2011-3363 [MEDIUM] CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount
CVE-2011-3363 kernel: cifs: always do is_path_accessible check in cifs_mount
Currently, we skip doing the is_path_accessible check in cifs_mount if
there is no prefixpath. There is a report of at least one server however
that allows a TREE_CONNECT to a share that has a DFS referral at its
root. UNC that had no prefixpath was used in that case, so the
is_path_accessible check was not triggered and the box later hit
a BUG() because we were chasing a DFS referral on the root dentry for
the mount.
Upstream fix:
70945643722ffeac779d2529a348f99567fa5c33
References:
https://bugzilla.redhat.com/show_bug.cgi?id=682829
https://github.com/torvalds/linux/commit/70945643722ffeac779d2529a348f99567fa5c33
Acknowledgements:
Red Hat would like to thank Yogesh Sharma for reporting this issue.
Discussi
http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=70945643722ffeac779d2529a348f99567fa5c33http://www.openwall.com/lists/oss-security/2011/09/14/12https://bugzilla.redhat.com/show_bug.cgi?id=738291https://github.com/torvalds/linux/commit/70945643722ffeac779d2529a348f99567fa5c33http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=70945643722ffeac779d2529a348f99567fa5c33http://www.openwall.com/lists/oss-security/2011/09/14/12https://bugzilla.redhat.com/show_bug.cgi?id=738291https://github.com/torvalds/linux/commit/70945643722ffeac779d2529a348f99567fa5c33
2012-05-24
Published