CVE-2011-1495 — kernel: drivers/scsi/mpt2sas: prevent heap overflows

Back Back to CVE browser

HIGH

kernel: drivers/scsi/mpt2sas: prevent heap overflows

Published May 3, 2011

7.2

HIGH

CVSS 2.0

EPSS 0.37%

Description

drivers/scsi/mpt2sas/mpt2sas_ctl.c in the Linux kernel 2.6.38 and earlier does not validate (1) length and (2) offset values before performing memory copy operations, which might allow local users to gain privileges, cause a denial of service (memory corruption), or obtain sensitive information from kernel memory via a crafted ioctl call, related to the _ctl_do_mpt_command and _ctl_diag_read_buffer functions.

Affected products

Red Hat Enterprise Linux 5

kernel-0:2.6.18-238.12.1.el5

Fixed · RHSA-2011:0833
Red Hat Enterprise Linux 6

kernel-0:2.6.32-131.0.15.el6

Fixed · RHSA-2011:0542
Red Hat Enterprise Linux 6.0 EUS - Server Only

kernel-0:2.6.32-71.31.1.el6

Fixed · RHSA-2011:0883
Red Hat Enterprise MRG 2

kernel-rt-0:2.6.33.9-rt31.75.el6rt

Fixed · RHSA-2011:1253
Red Hat Enterprise Linux 4

kernel

Not affected
Red Hat Enterprise MRG 1

kernel-rt

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel-0:2.6.18-238.12.1.el5	Fixed	RHSA-2011:0833
Red Hat Enterprise Linux 6	kernel-0:2.6.32-131.0.15.el6	Fixed	RHSA-2011:0542
Red Hat Enterprise Linux 6.0 EUS - Server Only	kernel-0:2.6.32-71.31.1.el6	Fixed	RHSA-2011:0883
Red Hat Enterprise MRG 2	kernel-rt-0:2.6.33.9-rt31.75.el6rt	Fixed	RHSA-2011:1253
Red Hat Enterprise Linux 4	kernel	Not affected	n/a
Red Hat Enterprise MRG 1	kernel-rt	Affected	n/a

Remediation

Red Hat statement

This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 4 as it did not provide support for MPT (Message Passing Technology) based controllers. This has been addressed in Red Hat Enterprise Linux 5, 6, and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0833.html, and https://rhn.redhat.com/errata/RHSA-2011-0542.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html.

Metrics

0.37% 0.00367

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00367

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.37% (0.00367)	28.13th	v5 (v2026.06.15)
Jun 15, 2026	0.37% (0.00370)	28.54th	v5 (v2026.06.15)
Mar 17, 2025	0.11% (0.00113)	27.49th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	1.28% (0.01282)	68.34th	v2 (v2022.01.01)
Feb 13, 2023	1.28% (0.01282)	67.79th	v2 (v2022.01.01)
Feb 3, 2023	1.55% (0.01547)	74.40th	v2 (v2022.01.01)
Apr 1, 2022	1.28% (0.01282)	65.91th	v2 (v2022.01.01)
Feb 4, 2022	1.28% (0.01282)	41.72th	v2 (v2022.01.01)

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-20

Improper Input Validation

References (15)

http://downloads.avaya.com/css/P8/documents/100145416
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
vendor-advisoryx_refsource_SUSE
http://lkml.org/lkml/2011/4/5/327
mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/04/05/32
mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/04/06/2
mailing-listx_refsource_MLISTPatch
http://rhn.redhat.com/errata/RHSA-2011-0833.html
vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/46397
third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/520102/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/47185
vdb-entryx_refsource_BID
http://www.vmware.com/security/advisories/VMSA-2011-0012.html
x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-1495
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=694021
x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1495
https://patchwork.kernel.org/patch/688021/
x_refsource_CONFIRMPatch
https://www.cve.org/CVERecord?id=CVE-2011-1495

Link	Providers	Tags
http://downloads.avaya.com/css/P8/documents/100145416		x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html		vendor-advisoryx_refsource_SUSE
http://lkml.org/lkml/2011/4/5/327		mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/04/05/32		mailing-listx_refsource_MLISTPatch
http://openwall.com/lists/oss-security/2011/04/06/2		mailing-listx_refsource_MLISTPatch
http://rhn.redhat.com/errata/RHSA-2011-0833.html		vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/46397		third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/520102/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/47185		vdb-entryx_refsource_BID
http://www.vmware.com/security/advisories/VMSA-2011-0012.html		x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2011-1495		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=694021		x_refsource_CONFIRMPatchIssue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1495
https://patchwork.kernel.org/patch/688021/		x_refsource_CONFIRMPatch
https://www.cve.org/CVERecord?id=CVE-2011-1495