CVE-2011-2525

EUVD-2011-2510
The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
linuxlinux_kernel
𝑥
< 2.6.35
redhatenterprise_linux
4.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
hardy
Fixed 2.6.24-30.96
released
lucid
Fixed 2.6.32-36.79
released
maverick
Fixed 2.6.35-1.1
released
natty
not-affected
oneiric
not-affected
precise
not-affected
quantal
not-affected
raring
not-affected
saucy
not-affected
trusty
not-affected
utopic
not-affected
vivid
not-affected
wily
not-affected
linux-armadaxp
hardy
dne
lucid
dne
natty
dne
oneiric
dne
precise
not-affected
quantal
not-affected
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-ec2
hardy
dne
lucid
Fixed 2.6.32-340.40
released
maverick
ignored
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-flo
lucid
dne
precise
dne
quantal
dne
saucy
dne
trusty
dne
utopic
not-affected
vivid
not-affected
wily
not-affected
linux-fsl-imx51
hardy
dne
lucid
Fixed 2.6.31-611.29
released
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-goldfish
lucid
dne
precise
dne
quantal
dne
saucy
ignored
trusty
dne
utopic
not-affected
vivid
not-affected
wily
not-affected
linux-grouper
lucid
dne
precise
dne
quantal
dne
saucy
ignored
trusty
dne
utopic
not-affected
vivid
dne
wily
dne
linux-lts-backport-maverick
hardy
dne
lucid
ignored
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-backport-natty
hardy
dne
lucid
Fixed 2.6.38-1.27~lucid1
released
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-backport-oneiric
hardy
dne
lucid
not-affected
maverick
dne
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-quantal
hardy
dne
lucid
dne
oneiric
dne
precise
not-affected
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-raring
hardy
dne
lucid
dne
oneiric
dne
precise
not-affected
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-saucy
lucid
dne
precise
not-affected
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-trusty
lucid
dne
precise
not-affected
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-utopic
lucid
dne
precise
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-lts-vivid
lucid
dne
precise
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-maguro
lucid
dne
precise
dne
quantal
dne
saucy
ignored
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-mako
lucid
dne
precise
dne
quantal
dne
saucy
ignored
trusty
dne
utopic
not-affected
vivid
not-affected
wily
not-affected
linux-manta
lucid
dne
precise
dne
quantal
dne
saucy
ignored
trusty
dne
utopic
not-affected
vivid
not-affected
wily
not-affected
linux-mvl-dove
hardy
dne
lucid
ignored
maverick
Fixed 2.6.32-420.38
released
natty
dne
oneiric
dne
precise
dne
quantal
dne
raring
dne
saucy
dne
trusty
dne
utopic
dne
vivid
dne
wily
dne
linux-raspi2
precise
dne
trusty
dne
vivid
dne
wily
not-affected
linux-ti-omap4
hardy
dne
lucid
dne
maverick
ignored
natty
not-affected
oneiric
not-affected
precise
not-affected
quantal
not-affected
raring
not-affected
saucy
not-affected
trusty
dne
utopic
dne
vivid
dne
wily
dne
Common Weakness Enumeration
References
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=53b0f08042f04813cd1a7473dacd3edfacb28eb3
http://kerneltrap.org/mailarchive/linux-netdev/2010/5/21/6277805
http://mirror.anl.gov/pub/linux/kernel/v2.6/ChangeLog-2.6.35
http://openwall.com/lists/oss-security/2011/07/12/1
http://rhn.redhat.com/errata/RHSA-2011-1065.html
http://rhn.redhat.com/errata/RHSA-2011-1163.html
https://bugzilla.redhat.com/show_bug.cgi?id=720552
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=53b0f08042f04813cd1a7473dacd3edfacb28eb3
http://kerneltrap.org/mailarchive/linux-netdev/2010/5/21/6277805
http://mirror.anl.gov/pub/linux/kernel/v2.6/ChangeLog-2.6.35
http://openwall.com/lists/oss-security/2011/07/12/1
http://rhn.redhat.com/errata/RHSA-2011-1065.html
http://rhn.redhat.com/errata/RHSA-2011-1163.html
https://bugzilla.redhat.com/show_bug.cgi?id=720552