Buffer overflow in Linux Kernel

CVE-2011-0521

The dvb_ca_ioctl function in drivers/media/dvb/ttpci/av7110_ca.c in the Linux kernel before 2.6.38-rc2 does not check the sign of a certain integer field, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a negative value.

Vulnerability class: Buffer Overflow

EPSS: 0.004 (33.1th percentile) — read the EPSS interpretation.

Affected products

Linux Linux_kernel — versions 2.6.38
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch, Mailing List, Third Party Advisory)
secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_XF)
secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
secalert@redhat.com (x_refsource_CONFIRM, Broken Link)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch, Mailing List, Third Party Advisory)