CVE-2011-4127
N/A
Published: July 3, 2012 at 04:00 PM UTC
Updated: June 16, 2026 at 11:34 PM UTC
2 products affected across 2 vendorsLinux KernelLinux Enterprise Server
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.6%
Description
The Linux kernel before 3.2.2 does not properly restrict SG_IO ioctl calls, which allows local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v ≤ 3.2.13.0 rc13.0 rc23.0 rc33.0 rc43.0 rc53.0 rc63.0 rc73.0.13.0.103.0.113.0.123.0.133.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.213.0.223.0.233.0.243.0.253.0.263.0.273.0.283.0.293.0.33.0.303.0.313.0.323.0.333.0.343.0.43.0.53.0.63.0.73.0.83.0.93.13.1 rc13.1 rc23.1 rc33.1 rc43.1.13.1.103.1.23.1.33.1.43.1.53.1.63.1.73.1.83.1.93.2
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
- https://github.com/torvalds/linux/commit/0bfc96cb77224736dfa35c3c555d37b3646ef35e
- https://github.com/torvalds/linux/commit/ec8013beddd717d1740cfefb1a9b900deef85462
References (10)
Vendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.htmlVendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.htmlx_refsource_CONFIRM
Source: [email protected]
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.2Mailing Listx_refsource_MLIST
Source: [email protected]
http://www.openwall.com/lists/oss-security/2011/12/22/5Quick Info
StatusMODIFIED
CWE
CWE-264
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card