VYPR
Unrated severityNVD Advisory· Published Mar 1, 2013· Updated Apr 29, 2026

CVE-2011-1182

CVE-2011-1182

Description

kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.

Affected products

7

Patches

1
da48524eb206

Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code

https://github.com/torvalds/linuxJulien TinnesMar 18, 2011via nvd-ref
1 file changed · +12 4
  • kernel/signal.c+12 4 modified
    @@ -2421,9 +2421,13 @@ SYSCALL_DEFINE3(rt_sigqueueinfo, pid_t, pid, int, sig,
     		return -EFAULT;
     
     	/* Not even root can pretend to send signals from the kernel.
    -	   Nor can they impersonate a kill(), which adds source info.  */
    -	if (info.si_code >= 0)
    +	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
    +	 */
    +	if (info.si_code != SI_QUEUE) {
    +		/* We used to allow any < 0 si_code */
    +		WARN_ON_ONCE(info.si_code < 0);
     		return -EPERM;
    +	}
     	info.si_signo = sig;
     
     	/* POSIX.1b doesn't mention process groups.  */
    @@ -2437,9 +2441,13 @@ long do_rt_tgsigqueueinfo(pid_t tgid, pid_t pid, int sig, siginfo_t *info)
     		return -EINVAL;
     
     	/* Not even root can pretend to send signals from the kernel.
    -	   Nor can they impersonate a kill(), which adds source info.  */
    -	if (info->si_code >= 0)
    +	 * Nor can they impersonate a kill()/tgkill(), which adds source info.
    +	 */
    +	if (info->si_code != SI_QUEUE) {
    +		/* We used to allow any < 0 si_code */
    +		WARN_ON_ONCE(info->si_code < 0);
     		return -EPERM;
    +	}
     	info->si_signo = sig;
     
     	return do_send_specific(tgid, pid, sig, info);
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.