CVE-2011-1494 — kernel: drivers/scsi/mpt2sas: prevent heap overflows

Back Back to CVE browser

MEDIUM

kernel: drivers/scsi/mpt2sas: prevent heap overflows

Published May 3, 2011

6.9

MEDIUM

CVSS 2.0

EPSS 0.37%

Description

Integer overflow in the _ctl_do_mpt_command function in drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier might allow local users to gain privileges or cause a denial of service (memory corruption) via an ioctl call specifying a crafted value that triggers a heap-based buffer overflow.

Affected products

Red Hat Enterprise Linux 5

kernel-0:2.6.18-238.12.1.el5

Fixed · RHSA-2011:0833
Red Hat Enterprise Linux 6

kernel-0:2.6.32-131.0.15.el6

Fixed · RHSA-2011:0542
Red Hat Enterprise Linux 6.0 EUS - Server Only

kernel-0:2.6.32-71.31.1.el6

Fixed · RHSA-2011:0883
Red Hat Enterprise MRG 2

kernel-rt-0:2.6.33.9-rt31.75.el6rt

Fixed · RHSA-2011:1253
Red Hat Enterprise Linux 4

kernel

Not affected
Red Hat Enterprise MRG 1

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel-0:2.6.18-238.12.1.el5	Fixed	RHSA-2011:0833
Red Hat Enterprise Linux 6	kernel-0:2.6.32-131.0.15.el6	Fixed	RHSA-2011:0542
Red Hat Enterprise Linux 6.0 EUS - Server Only	kernel-0:2.6.32-71.31.1.el6	Fixed	RHSA-2011:0883
Red Hat Enterprise MRG 2	kernel-rt-0:2.6.33.9-rt31.75.el6rt	Fixed	RHSA-2011:1253
Red Hat Enterprise Linux 4	kernel	Not affected	n/a
Red Hat Enterprise MRG 1	kernel-rt	Affected	n/a

Remediation

Red Hat statement

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not provide support for MPT (Message Passing Technology) based controllers. This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0833.html, and https://rhn.redhat.com/errata/RHSA-2011-0542.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html.

Metrics

0.37% 0.00371

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00371

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.37% (0.00371)	28.75th	v5 (v2026.06.15)
Jun 15, 2026	0.37% (0.00374)	29.01th	v5 (v2026.06.15)
Mar 17, 2025	0.14% (0.00145)	32.35th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	1.28% (0.01282)	68.34th	v2 (v2022.01.01)
Feb 13, 2023	1.28% (0.01282)	67.79th	v2 (v2022.01.01)
Feb 3, 2023	1.55% (0.01547)	74.40th	v2 (v2022.01.01)
Apr 1, 2022	1.28% (0.01282)	65.91th	v2 (v2022.01.01)
Feb 4, 2022	1.28% (0.01282)	41.72th	v2 (v2022.01.01)

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-189

References (15)

http://downloads.avaya.com/css/P8/documents/100145416
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
vendor-advisoryx_refsource_SUSE
http://lkml.org/lkml/2011/4/5/327
mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/04/05/32
mailing-listx_refsource_MLIST
http://openwall.com/lists/oss-security/2011/04/06/2
mailing-listx_refsource_MLISTPatch
http://rhn.redhat.com/errata/RHSA-2011-0833.html
vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/46397
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/archive/1/520102/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/47185
vdb-entryx_refsource_BID
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-1494
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=694021
x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1494
https://patchwork.kernel.org/patch/688021/
x_refsource_CONFIRMPatch
https://www.cve.org/CVERecord?id=CVE-2011-1494

Link	Providers	Tags
http://downloads.avaya.com/css/P8/documents/100145416		x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html		vendor-advisoryx_refsource_SUSE
http://lkml.org/lkml/2011/4/5/327		mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/04/05/32		mailing-listx_refsource_MLIST
http://openwall.com/lists/oss-security/2011/04/06/2		mailing-listx_refsource_MLISTPatch
http://rhn.redhat.com/errata/RHSA-2011-0833.html		vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/46397		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://www.securityfocus.com/archive/1/520102/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/47185		vdb-entryx_refsource_BID
http://www.vmware.com/security/advisories/VMSA-2011-0012.html		x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-1494		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=694021		x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1494
https://patchwork.kernel.org/patch/688021/		x_refsource_CONFIRMPatch
https://www.cve.org/CVERecord?id=CVE-2011-1494