CVE-2011-2525

The qdisc_notify function in net/sched/sch_api.c in the Linux kernel before 2.6.35 does not prevent tc_fill_qdisc function calls referencing builtin (aka CQ_F_BUILTIN) Qdisc structures, which allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted call.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
VendorProductVersion
linuxlinux_kernel
𝑥
< 2.6.35
redhatenterprise_linux
4.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
linux
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
not-affected
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
not-affected
maverick
Fixed 2.6.35-1.1
released
lucid
Fixed 2.6.32-36.79
released
hardy
Fixed 2.6.24-30.96
released
linux-armadaxp
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
not-affected
precise
not-affected
oneiric
dne
natty
dne
lucid
dne
hardy
dne
linux-ec2
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
ignored
lucid
Fixed 2.6.32-340.40
released
hardy
dne
linux-flo
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
dne
quantal
dne
precise
dne
lucid
dne
linux-fsl-imx51
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
Fixed 2.6.31-611.29
released
hardy
dne
linux-goldfish
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-grouper
wily
dne
vivid
dne
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-lts-backport-maverick
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
ignored
hardy
dne
linux-lts-backport-natty
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
Fixed 2.6.38-1.27~lucid1
released
hardy
dne
linux-lts-backport-oneiric
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
dne
lucid
not-affected
hardy
dne
linux-lts-quantal
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
not-affected
oneiric
dne
lucid
dne
hardy
dne
linux-lts-raring
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
not-affected
oneiric
dne
lucid
dne
hardy
dne
linux-lts-saucy
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
not-affected
lucid
dne
linux-lts-trusty
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
precise
not-affected
lucid
dne
linux-lts-utopic
wily
dne
vivid
dne
utopic
dne
trusty
dne
precise
dne
lucid
dne
linux-lts-vivid
wily
dne
vivid
dne
utopic
dne
trusty
dne
precise
dne
lucid
dne
linux-maguro
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-mako
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-manta
wily
not-affected
vivid
not-affected
utopic
not-affected
trusty
dne
saucy
ignored
quantal
dne
precise
dne
lucid
dne
linux-mvl-dove
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
dne
raring
dne
quantal
dne
precise
dne
oneiric
dne
natty
dne
maverick
Fixed 2.6.32-420.38
released
lucid
ignored
hardy
dne
linux-raspi2
wily
not-affected
vivid
dne
trusty
dne
precise
dne
linux-ti-omap4
wily
dne
vivid
dne
utopic
dne
trusty
dne
saucy
not-affected
raring
not-affected
quantal
not-affected
precise
not-affected
oneiric
not-affected
natty
not-affected
maverick
ignored
lucid
dne
hardy
dne
Common Weakness Enumeration
References
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=53b0f08042f04813cd1a7473dacd3edfacb28eb3
http://kerneltrap.org/mailarchive/linux-netdev/2010/5/21/6277805
http://mirror.anl.gov/pub/linux/kernel/v2.6/ChangeLog-2.6.35
http://openwall.com/lists/oss-security/2011/07/12/1
http://rhn.redhat.com/errata/RHSA-2011-1065.html
http://rhn.redhat.com/errata/RHSA-2011-1163.html
https://bugzilla.redhat.com/show_bug.cgi?id=720552
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=53b0f08042f04813cd1a7473dacd3edfacb28eb3
http://kerneltrap.org/mailarchive/linux-netdev/2010/5/21/6277805
http://mirror.anl.gov/pub/linux/kernel/v2.6/ChangeLog-2.6.35
http://openwall.com/lists/oss-security/2011/07/12/1
http://rhn.redhat.com/errata/RHSA-2011-1065.html
http://rhn.redhat.com/errata/RHSA-2011-1163.html
https://bugzilla.redhat.com/show_bug.cgi?id=720552