CVE-2011-4914
5.9 Medium
AI Score
Confidence
High
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.023 Low
EPSS
Percentile
89.5%
The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the amount of data sent, which might allow remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read) via crafted data to a ROSE socket.
References
ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e0bccd315db0c2f919e7fcf9cb60db21d9986f52
lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
www.openwall.com/lists/oss-security/2011/12/28/2
bugzilla.redhat.com/show_bug.cgi?id=770777
github.com/torvalds/linux/commit/e0bccd315db0c2f919e7fcf9cb60db21d9986f52
Social References
More
Related
5.9 Medium
AI Score
Confidence
High
6.4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:N/A:P
0.023 Low
EPSS
Percentile
89.5%