Description
The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlinks, which allows local users to cause a denial of service (incorrect pointer dereference and OOPS) by accessing a long symlink on a malformed Be filesystem.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | linux-2.6 | 2.6.32-35squeeze1 | DSA-2303-1 |
| Debian 5.0 | linux-2.6 | 2.6.26-26lenny4 | DSA-2310-1 |
Advisories 2
- DSA-2303-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2310-1 linux-2.6 - several issues Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110819 Re: CVE request: Linux: ZERO_SIZE_PTR dereference for long symlinks in Be FS mailing-list
- http://www.pre-cert.de/advisories/PRE-SA-2011-06.txt
- 49256 vdb-entry
- [oss-security] 20110819 CVE request: Linux: ZERO_SIZE_PTR dereference for long symlinks in Be FS mailing-list
- 20110819 [PRE-SA-2011-06] Linux kernel: ZERO_SIZE_PTR dereference for long symlinks in Be FS mailing-list
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=338d0f0a6fbc82407864606f5b64b75aeb3c70f2
- linux-kernel-be-dos(69343) vdb-entry
- 8360 third-party-advisory
- http://www.kernel.org/pub/linux/kernel/v3.0/testing/ChangeLog-3.1-rc3