CVE-2011-4077

MediumCVSS 6.9/10Last modified Jun 16, 2026

Description

Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=139447903326211&w=2Mailing List, Third Party Advisory
http://oss.sgi.com/archives/xfs/2011-10/msg00345.htmlPatch, Third Party Advisory
http://secunia.com/advisories/48964Broken Link
http://www.openwall.com/lists/oss-security/2011/10/26/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2011/10/26/3Mailing List, Patch, Third Party Advisory
http://xorl.wordpress.com/2011/12/07/cve-2011-4077-linux-kernel-xfs-readlink-memory-corruption/Exploit, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=749156Issue Tracking, Patch, Third Party Advisory
http://marc.info/?l=bugtraq&m=139447903326211&w=2Mailing List, Third Party Advisory
http://oss.sgi.com/archives/xfs/2011-10/msg00345.htmlPatch, Third Party Advisory
http://secunia.com/advisories/48964Broken Link
http://www.openwall.com/lists/oss-security/2011/10/26/1Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2011/10/26/3Mailing List, Patch, Third Party Advisory
http://xorl.wordpress.com/2011/12/07/cve-2011-4077-linux-kernel-xfs-readlink-memory-corruption/Exploit, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=749156Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Jan 27, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-40785.0include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request CVE-2011-40794.0Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (sl CVE-2011-40804.0The sysrq_sysctl_handler function in kernel/sysctl.c in the Linux kernel before 2.6.39 does not require the CAP_SYS_ADMIN capability to modi CVE-2011-40815.5crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or CVE-2011-40827.5A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header CVE-2011-40834.3The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private e CVE-2011-40856.8The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform befor CVE-2011-40864.9The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritt CVE-2011-40877.5The br_parse_ip_options function in net/bridge/br_netfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data CVE-2011-40887.5ABRT might allow attackers to obtain sensitive information from crash reports.CVE-2011-40894.6The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction,CVE-2011-40906.1Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.