CVE-2011-4127 Security feature bypass in n/a

Medium 4.6 Published 3 Jul 2012 Updated 7 Aug 2024

Local attackers can bypass disk access restrictions on partitions or LVM volumes via SG_IO ioctl calls, enabling unauthorized read and write operations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2011-4127?

CVE-2011-4127 is a medium-severity vulnerability in Linux kernel, published on 3 Jul 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Linux kernel before 3.2.2 does not properly restrict SG_IO ioctl calls, which allows local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume.

Weakness: CWE-264

Which versions are affected by CVE-2011-4127?

It affects 2 products.

Linux distribution packages (2)

`rhev-hypervisor6` Red Hat:enterprise_linux:6::hypervisor	All versions	`0:6.2-20111215.0.el6_2`
`rhev-hypervisor6-tools` Red Hat:enterprise_linux:6::hypervisor	All versions	`0:6.2-20111215.0.el6_2`

Products include Linux kernel, Suse Linux Enterprise Server.

How do I fix CVE-2011-4127?

Apply the vendor's patch.

Is CVE-2011-4127 being exploited?

There is no known exploitation of CVE-2011-4127 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as DEBIAN-CVE-2011-4127, GHSA-hffv-wrg3-v4pp, RHSA-2011:1850.