CVE-2011-3209 Denial of service in n/a

Medium 4.9 Published 3 Oct 2012 Updated 6 Aug 2024

Local attackers can cause a system panic via a divide error fault in the Linux kernel's clock_gettime implementation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2011-3209?

CVE-2011-3209 is a medium-severity denial of service vulnerability in Linux kernel, published on 3 Oct 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The div_long_long_rem implementation in include/asm-x86/div64.h in the Linux kernel before 2.6.26 on the x86 platform allows local users to cause a denial of service (Divide Error Fault and panic) via a clock_gettime system call.

Weakness: CWE-189

Which versions are affected by CVE-2011-3209?

It affects 1 product.

Linux distribution packages (15)

`kernel` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-PAE` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-PAE-debuginfo` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-PAE-devel` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-debug` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-debug-debuginfo` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-debug-devel` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-debuginfo` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-debuginfo-common` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-devel` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-doc` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-headers` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-xen` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-xen-debuginfo` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`
`kernel-xen-devel` Red Hat:rhel_mission_critical:5.3	All versions	`0:2.6.18-128.36.1.el5`

Products include Linux kernel.

How do I fix CVE-2011-3209?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2011-3209 being exploited?

There is no known exploitation of CVE-2011-3209 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as GHSA-wwjm-fhqp-6cq8, RHSA-2011:1418.