CVE-2011-2707

MEDIUM

Linux Kernel < 3.1 - Unauthorized Kernel Memory Exposure via PTRACE_SETXTREGS Request

Title source: llm
STIX 2.1

Description

The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.

References (4)

Core 4
Core References
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/07/20/18
Mailing List, Patch, Vendor Advisory x_refsource_confirm
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1

Scores

CVSS v3 6.0
EPSS 0.0037
EPSS Percentile 28.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Details

CWE
CWE-200
Status published
Products (1)
linux/linux_kernel < 3.1
Published May 24, 2012
Tracked Since Feb 18, 2026