CVE-2011-1776 : The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensi

The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT) entry, which allows physically proximate attackers to cause a denial of service (heap-based buffer overflow and OOPS) or obtain sensitive information from kernel heap memory by connecting a crafted GPT storage device, a different vulnerability than CVE-2011-1577.

Published 2011-09-06 16:55:08

Updated 2023-02-13 01:19:31

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Threat overview for CVE-2011-1776

Top countries where our scanners detected CVE-2011-1776

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2011-1776 1,556

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2011-1776!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2011-1776

Probability of exploitation activity in the next 30 days: 0.32%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 67 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2011-1776

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:N/A:C	3.9	7.8	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Complete
6.1	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	0.9	5.2	NIST
Attack Vector: Physical Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2011-1776

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-1776

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fa039d5f6b126fbd65eefa05db2f67e44df8f121
https://bugzilla.redhat.com/show_bug.cgi?id=703026

703026 – (CVE-2011-1776) CVE-2011-1776 kernel: validate size of EFI GUID partition entries
Issue Tracking;Patch;Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2011-0927.html

RHSA-2011:0927 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39

404: File not found
Release Notes;Vendor Advisory

CVEs referencing this url
http://www.pre-cert.de/advisories/PRE-SA-2011-04.txt

Third Party Advisory
http://openwall.com/lists/oss-security/2011/05/10/4

oss-security - Re: CVE request: kernel: validate size of EFI GUID partition entries
Mailing List;Patch;Third Party Advisory
http://securityreason.com/securityalert/8369

linux kernel 2.6.38.8 information disclosure, denial-of-service - CXSecurity.com
Third Party Advisory
http://www.securityfocus.com/bid/47796

Linux Kernel EFI Partition Buffer Overflow Vulnerability
Third Party Advisory;VDB Entry

Products affected by CVE-2011-1776