Upstream information

CVE-2011-1019 at MITRE

Description

The dev_load function in net/core/dev.c in the Linux kernel before 2.6.38 allows local users to bypass an intended CAP_SYS_MODULE capability requirement and load arbitrary modules by leveraging the CAP_NET_ADMIN capability.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 1.9
Vector AV:L/AC:M/Au:N/C:N/I:P/A:N
Access Vector Local
Access Complexity Medium
Authentication None
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

Note from the SUSE Security Team

The problems within this security feature were resolved during the SUSE Linux Enterprise 11 SP1 lifetime and were fixed before SUSE Linux Enterprise 11 SP2 shipment. Older products do not include this security feature. Newer products are not affected by this issue.

SUSE Bugzilla entry: 674978 [RESOLVED / UPSTREAM]

No SUSE Security Announcements cross referenced.