Vulnerability in Linux Kernel
CVE-2011-1493
Array index error in the rose_parse_national function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by composing FAC_NATIONAL_DIGIS data that specifies a large number of digipeaters, and then sending this data to a ROSE socket.
EPSS: 0.034 (87.5th percentile) — read the EPSS interpretation.
Affected products
- Linux Linux_kernel — versions 2.6.38, 2.6.38.1, 2.6.38.2
- N/a — versions n/a
Public proof-of-concept exploits
- ARPSyndicate/cvemon
- R0B1NL1N/linux-kernel-exploitation
- Technoashofficial/kernel-exploitation-linux
- kdn111/linux-kernel-exploitation
- khanhdn111/linux-kernel-exploitation
- khanhdz-06/linux-kernel-exploitation
- khanhdz191/linux-kernel-exploitation
- khanhhdz/linux-kernel-exploitation
- khanhhdz06/linux-kernel-exploitation
- khanhnd123/linux-kernel-exploitation
References
- secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2011-1493?
- CVE-2011-1493 is a vulnerability in Linux Kernel. Published 2012-06-21.
- Is CVE-2011-1493 known to be exploited?
- 18 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.