PT-2012-1031 · Linux+3 · Linux Kernel+3

Steve Grubb · Publicado 2012-04-19 · Atualizado 2023-10-12 · CVE-2012-2123

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.3.3

Description The issue arises from the improper handling of file system capabilities in the Linux kernel, allowing local users to bypass intended personality restrictions. This can be achieved through a crafted application, as demonstrated by an attack where a parent process is used to disable Address Space Layout Randomization (ASLR).

Recommendations For Linux kernel versions prior to 3.3.3, update to version 3.3.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of file system capabilities to minimize the risk of exploitation.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-264

Identificadores relacionados

BDU:2015-01796

CESA-2012_0743

CVE-2012-2123

DSA-2469-1

RHSA-2012:0670

RHSA-2012:0743

RHSA-2012_0743

SUSE-SU-2012_0904-1

USN-1445-1

USN-1448-1

USN-1452-1

USN-1453-1

USN-1455-1

USN-1457-1

USN-1459-1

USN-1460-1

USN-1470-1

USN-1530-1

Produtos afetados

Centos

Linux Kernel

Red Hat

Suse

Referências · 34

• https://github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445 · Nota
• http://debian.org/security/dsa-2469 · Nota
• http://rhn.redhat.com/errata/RHSA-2012-0743.html · Aviso do Fabricante
• http://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-1460-1 · Aviso do Fabricante
• http://securitytracker.com/id?1027072 · Nota
• https://linux.oracle.com/errata/ELSA-2012-0743.html · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-0670.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75043 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=806722 · Nota
• https://ubuntu.com/security/notices/USN-1445-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1601 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-1459-1 · Aviso do Fabricante