CVE-2011-1044 : The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initia

The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.

Published 2011-02-18 20:00:09

Updated 2020-08-12 19:39:24

Source MITRE

View at NVD, CVE.org

Threat overview for CVE-2011-1044

Top countries where our scanners detected CVE-2011-1044

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2011-1044 2,923

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2011-1044!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2011-1044

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2011-1044

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None

CWE ids for CVE-2011-1044

CWE-909 Missing Initialization of Resource

The product does not initialize a critical resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-1044

http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37

404: File not found
Broken Link

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2011-0927.html

RHSA-2011:0927 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7182afea8d1afd432a17c18162cc3fd441d0da93

kernel/git/torvalds/linux.git - Linux kernel source tree
Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/65563

Linux Kernel ib_uverbs_poll_cq information disclosure CVE-2011-1044 Vulnerability Report
Third Party Advisory;VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=667916

667916 – (CVE-2010-4649, CVE-2011-1044) CVE-2010-4649 CVE-2011-1044 kernel: IB/uverbs: Handle large number of entries in poll CQ
Issue Tracking;Patch;Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/46488

Linux Kernel 'ib_uverbs_poll_cq()' Function Local Information Disclosure Vulnerability
Third Party Advisory;VDB Entry

Products affected by CVE-2011-1044