CVE-2011-2203 — kernel: hfs_find_init() sb->ext_tree NULL pointer dereference

Back Back to CVE browser

LOW

kernel: hfs_find_init() sb->ext_tree NULL pointer dereference

Published Jan 27, 2012

2.1

LOW

CVSS 2.0

EPSS 0.43%

Description

The hfs_find_init function in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and Oops) by mounting an HFS file system with a malformed MDB extent record.

Affected products

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel-0:2.6.18-274.12.1.el5	Fixed	RHSA-2011:1479

Remediation

Red Hat statement

This issue did not affect the versions of Linux kernel as shipped in Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they did not provide support for the Hierarchical File System (HFS). This has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2011-1479.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.

Metrics

0.43% 0.00428

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00428

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.43% (0.00428)	34.74th	v5 (v2026.06.15)
Jun 15, 2026	0.44% (0.00444)	35.16th	v5 (v2026.06.15)
Mar 17, 2025	0.14% (0.00139)	31.33th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	1.10% (0.01104)	54.09th	v2 (v2022.01.01)
Feb 13, 2023	1.10% (0.01104)	53.53th	v2 (v2022.01.01)
Feb 3, 2023	1.28% (0.01282)	67.60th	v2 (v2022.01.01)
Sep 17, 2022	1.10% (0.01104)	52.45th	v2 (v2022.01.01)
Apr 1, 2022	1.10% (0.01104)	50.41th	v2 (v2022.01.01)
Feb 4, 2022	1.10% (0.01104)	28.85th	v2 (v2022.01.01)

Weaknesses (2)

CWE-264

CWE-476

NULL Pointer Dereference

References (11)

http://secunia.com/advisories/47754
third-party-advisoryx_refsource_SECUNIA
http://www.openwall.com/lists/oss-security/2011/06/13/16
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/48236
vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-1324-1
vendor-advisoryx_refsource_UBUNTU
http://www.ubuntu.com/usn/USN-1328-1
vendor-advisoryx_refsource_UBUNTU
http://www.ubuntu.com/usn/USN-1344-1
vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2011-2203
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=712774
x_refsource_CONFIRMExploitPatchIssue Tracking
https://lkml.org/lkml/2011/6/8/154
mailing-listx_refsource_MLISTExploit
https://nvd.nist.gov/vuln/detail/CVE-2011-2203
https://www.cve.org/CVERecord?id=CVE-2011-2203

Link	Providers	Tags
http://secunia.com/advisories/47754		third-party-advisoryx_refsource_SECUNIA
http://www.openwall.com/lists/oss-security/2011/06/13/16		mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/48236		vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-1324-1		vendor-advisoryx_refsource_UBUNTU
http://www.ubuntu.com/usn/USN-1328-1		vendor-advisoryx_refsource_UBUNTU
http://www.ubuntu.com/usn/USN-1344-1		vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2011-2203		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=712774		x_refsource_CONFIRMExploitPatchIssue Tracking
https://lkml.org/lkml/2011/6/8/154		mailing-listx_refsource_MLISTExploit
https://nvd.nist.gov/vuln/detail/CVE-2011-2203
https://www.cve.org/CVERecord?id=CVE-2011-2203