SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2011-3149

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU…

LOW 2.1EPSS 0.53%

Does this matter?

Lower severity and a low EPSS score (0.53%). Track it; it rarely justifies an emergency change on its own.

Description

The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).

CVSS 2.0
2.1 LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
EPSS
0.53% probability · 43th percentile
CISA KEV
Not listed
Weakness
CWE-119
Affected
linux-pam/linux-pam
Source
cve@mitre.org

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.