CVE-2011-4080

MediumCVSS 4.0/10Last modified Jun 16, 2026

Description

The sysrq_sysctl_handler function in kernel/sysctl.c in the Linux kernel before 2.6.39 does not require the CAP_SYS_ADMIN capability to modify the dmesg_restrict value, which allows local users to bypass intended access restrictions and read the kernel ring buffer by leveraging root privileges, as demonstrated by a root user in a Linux Containers (aka LXC) environment.

Metrics

CVSS 2.0 4.0/10AV:L/AC:H/Au:N/C:C/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bfdc0b497faa82a0ba2f9dddcf109231dd519fcc
http://www.openwall.com/lists/oss-security/2011/10/26/10Mailing List, Third Party Advisory
https://github.com/torvalds/linux/commit/bfdc0b497faa82a0ba2f9dddcf109231dd519fccPatch, Third Party Advisory
http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.39Broken Link
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bfdc0b497faa82a0ba2f9dddcf109231dd519fcc
http://www.openwall.com/lists/oss-security/2011/10/26/10Mailing List, Third Party Advisory
https://github.com/torvalds/linux/commit/bfdc0b497faa82a0ba2f9dddcf109231dd519fccPatch, Third Party Advisory

Timeline

Published: May 24, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-40815.5crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or CVE-2011-40827.5A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header CVE-2011-40834.3The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private e CVE-2011-40856.8The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform befor CVE-2011-40864.9The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritt CVE-2011-40877.5The br_parse_ip_options function in net/bridge/br_netfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data CVE-2011-40887.5ABRT might allow attackers to obtain sensitive information from crash reports.CVE-2011-40894.6The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction,CVE-2011-40906.1Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.CVE-2011-40915.0The libobby server in inc/server.hpp in libnet6 (aka net6) before 1.3.14 does not perform authentication before checking the user name, whic CVE-2011-40925.8obby (aka libobby) does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate.CVE-2011-40935.8Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privilege