CVE-2011-1090 — kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab

Back Back to CVE browser

MEDIUM

kernel: nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab

Published May 9, 2011

4.9

MEDIUM

CVSS 2.0

EPSS 0.42%

Description

The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.

Affected products

Red Hat Enterprise Linux 5

kernel-0:2.6.18-238.9.1.el5

Fixed · RHSA-2011:0429
Red Hat Enterprise Linux 6

kernel-0:2.6.32-131.0.15.el6

Fixed · RHSA-2011:0542
Red Hat Enterprise Linux 6.0 EUS - Server Only

kernel-0:2.6.32-71.31.1.el6

Fixed · RHSA-2011:0883
Red Hat Enterprise MRG 2

kernel-rt-0:2.6.33.9-rt31.75.el6rt

Fixed · RHSA-2011:1253
Red Hat Enterprise MRG 1

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel-0:2.6.18-238.9.1.el5	Fixed	RHSA-2011:0429
Red Hat Enterprise Linux 6	kernel-0:2.6.32-131.0.15.el6	Fixed	RHSA-2011:0542
Red Hat Enterprise Linux 6.0 EUS - Server Only	kernel-0:2.6.32-71.31.1.el6	Fixed	RHSA-2011:0883
Red Hat Enterprise MRG 2	kernel-rt-0:2.6.33.9-rt31.75.el6rt	Fixed	RHSA-2011:1253
Red Hat Enterprise MRG 1	kernel-rt	Affected	n/a

Remediation

Red Hat statement

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not backport the upstream commit 4b580ee3 that introduced this issue. This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0429.html, https://rhn.redhat.com/errata/RHSA-2011-0542.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html.

Metrics

0.42% 0.00417

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00417

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.42% (0.00417)	33.65th	v5 (v2026.06.15)
Jun 15, 2026	0.44% (0.00438)	34.69th	v5 (v2026.06.15)
Mar 17, 2025	0.17% (0.00170)	35.91th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	1.28% (0.01282)	68.34th	v2 (v2022.01.01)
Feb 13, 2023	1.28% (0.01282)	67.79th	v2 (v2022.01.01)
Feb 3, 2023	1.55% (0.01547)	74.40th	v2 (v2022.01.01)
Apr 1, 2022	1.28% (0.01282)	65.91th	v2 (v2022.01.01)
Feb 4, 2022	1.28% (0.01282)	41.72th	v2 (v2022.01.01)

Weaknesses (1)

CWE-399

References (13)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9e3d724e2145f5039b423c290ce2b2c3d8f94bc
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
vendor-advisoryx_refsource_SUSE
http://openwall.com/lists/oss-security/2011/03/07/12
mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/03/07/2
mailing-listx_refsource_MLISTPatch
http://secunia.com/advisories/46397
third-party-advisoryx_refsource_SECUNIA
http://securitytracker.com/id?1025336
vdb-entryx_refsource_SECTRACK
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38
x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/520102/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-1090
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=682641
x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1090
https://www.cve.org/CVERecord?id=CVE-2011-1090

Link	Providers	Tags
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9e3d724e2145f5039b423c290ce2b2c3d8f94bc		x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html		vendor-advisoryx_refsource_SUSE
http://openwall.com/lists/oss-security/2011/03/07/12		mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/03/07/2		mailing-listx_refsource_MLISTPatch
http://secunia.com/advisories/46397		third-party-advisoryx_refsource_SECUNIA
http://securitytracker.com/id?1025336		vdb-entryx_refsource_SECTRACK
http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.38		x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/520102/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.vmware.com/security/advisories/VMSA-2011-0012.html		x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-1090		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=682641		x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1090
https://www.cve.org/CVERecord?id=CVE-2011-1090

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published May 9, 2011

Updated Aug 6, 2024

Reserved Feb 24, 2011

Link CVE-2011-1090

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2011-1090

Red Hat

Severity Moderate

Public date Mar 5, 2011

Links CVE-2011-1090 - Bugzilla