{
  "threat_severity" : "Low",
  "public_date" : "2011-05-09T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace",
    "id" : "703019",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=703019"
  },
  "cvss" : {
    "cvss_base_score" : "1.9",
    "cvss_scoring_vector" : "AV:L/AC:M/Au:N/C:P/I:N/A:N",
    "status" : "verified"
  },
  "details" : [ "The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c." ],
  "statement" : "This issue affects the versions of Linux kernel as shipped with Red Hat Enterprise Linux 4, 5, 6, and Red Hat Enterprise MRG. It has been addressed in Red Hat Enterprise Linux 5, 6 and Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0927.html, https://rhn.redhat.com/errata/RHSA-2011-1189.html, and https://rhn.redhat.com/errata/RHSA-2011-1253.html. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.",
  "acknowledgement" : "Red Hat would like to thank Filip Palian and Marek Kroemeke for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "release_date" : "2011-07-15T00:00:00Z",
    "advisory" : "RHSA-2011:0927",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5",
    "package" : "kernel-0:2.6.18-238.19.1.el5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "release_date" : "2011-08-23T00:00:00Z",
    "advisory" : "RHSA-2011:1189",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6",
    "package" : "kernel-0:2.6.32-131.12.1.el6"
  }, {
    "product_name" : "Red Hat Enterprise MRG 2",
    "release_date" : "2011-09-12T00:00:00Z",
    "advisory" : "RHSA-2011:1253",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:2:server:el6",
    "package" : "kernel-rt-0:2.6.33.9-rt31.75.el6rt"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise MRG 1",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:1"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2011-2492\nhttps://nvd.nist.gov/vuln/detail/CVE-2011-2492" ],
  "name" : "CVE-2011-2492",
  "csaw" : false
}