Skip to content
OpenAdvisories
Unscored CVE-2011-2495 EUVD-2011-2482GHSA-qfq8-33vr-83jg

fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io files, which allows local users to o…

Published Jun 13, 2012 · Updated Aug 6, 2024 · Assigned by redhat

Description

fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 6.0 linux-2.6 2.6.32-35squeeze1 DSA-2303-1
Debian 5.0 linux-2.6 2.6.26-26lenny4 DSA-2310-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 perf +14 2.6.32-131.12.1.el6 RHSA-2011:1189
RHEL 5 kernel +11 2.6.18-274.3.1.el5 RHSA-2011:1212
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 5.6 EUS kernel +11 2.6.18-238.31.1.el5 RHSA-2011:1813
Red Hat MRG 2 kernel-rt +10 2.6.33.9-rt31.75.el6rt RHSA-2011:1253

Advisories 6

References