CVE-2011-0726

Función do_task_stat en fs/proc/array.c en el kernel de linux antes de v2.6.39-rc1 no realiza una comprobación de uid esperado, lo que hace que sea más fácil para los usuarios locales derrotar a los mecanismos de protección ASLR mediante la lectura de los campos start_code y end_code en el archivo /proc/#####/stat para un proceso ejecutando un binario PIE.

Dan Rosenberg discovered that IRDA did not correctly check the size of buffers. On non-x86 systems, a local attacker could exploit this to read kernel heap memory, leading to a loss of privacy. Dan Rosenburg discovered that the CAN subsystem leaked kernel addresses into the /proc filesystem. A local attacker could use this to increase the chances of a successful memory corruption exploit. Kees Cook discovered that the IOWarrior USB device driver did not correctly check certain size fields. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges. Various other issues were also addressed.