Sensitive Keystroke Information Exposure in Linux Kernel - linux Package Vulnerability
Summary
UBUNTU-CVE-2011-4916: Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/tty*. Affects linux versions 3.11.0-12.19 – 3.13.0-98.145. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The linux package is a core component of the Ubuntu operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and services on the system. This package is critical for system stability and performance, and vulnerabilities within it can have severe implications for user security and data integrity.
Vulnerability Detail
The vulnerability identified as CVE-2011-4916 affects the Linux kernel through version 3.1, allowing local users to access sensitive keystroke information via the /dev/pts/ and /dev/tty* interfaces. This exposure can lead to unauthorized access to confidential data, including passwords and personal information, posing a significant risk to user privacy and system security. The vulnerability arises from insufficient access controls, enabling malicious users to exploit the system's terminal interfaces.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the /dev/pts/ and /dev/tty* devices by modifying the permissions or using access control lists (ACLs) to limit access to trusted users only. This can be done using the following command: sudo chmod 700 /dev/pts/ and sudo chmod 700 /dev/tty*.
Conclusion
The CVE-2011-4916 vulnerability in the Linux kernel poses a significant risk by allowing local users to access sensitive keystroke information. It is crucial to update the linux package to the patched version to mitigate this risk. Users should also consider implementing temporary workarounds to enhance security until the update can be applied.
See every vulnerability recorded for linux →
FAQ
CVE-2011-4916 is a vulnerability in the Linux kernel that allows local users to access sensitive keystroke information.
If exploited, this vulnerability can lead to unauthorized access to sensitive information, including passwords and personal data.
Yes, updating the linux package to version 3.13.0-207.259 or later will address this vulnerability.
You can implement temporary workarounds by restricting access to the affected device files.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
