OpenBSD contains a flaw in the Kernel DRM subsystem that may allow a local denial of service. The issue is triggered when an out-of-bounds write error occurs in the drm_modeset_ctl function of sys/dev/pci/drm/drm_irq.c. This may allow a local attacker to cause a loss of availability for the system.

Upgrade to version 4.9 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• CVE ID: 2011-1013 (see also: NVD)
• Secunia Advisory ID: 44435 44442 44543 44544 44774 45019 45032 45116 45212 45458 45509 45997 46003
• Bugtraq ID: 47639
• ISS X-Force ID: 67199
• Related OSVDB ID: 73290
• Vendor Specific News/Changelog Entry: http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061668.html
  http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00006.html
  http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00008.html
  http://lists.opensuse.org/opensuse-updates/2011-04/msg00083.html
  http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/pci/drm/drm_irq.c
  http://www.openbsd.org/cgi-bin/cvsweb/src/sys/dev/pci/drm/drm_irq.c.diff?r1=1.41;r2=1.42;f=h
  https://bugzilla.redhat.com/show_bug.cgi?id=679925
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-July/001372.html
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-June/001342.html
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-September/001412.html
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-September/001414.html
• Vendor URL: http://www.openbsd.org/
• Vendor Specific Advisory URL: http://www.ubuntu.com/usn/usn-1162-1/
  https://hermes.opensuse.org/messages/10455025
  https://lists.ubuntu.com/archives/ubuntu-security-announce/2011-August/001391.html
• RedHat RHSA: https://rhn.redhat.com/errata/RHSA-2011-0498.html
  https://rhn.redhat.com/errata/RHSA-2011-0500.html

• Matthiew Herrb