PT-2012-1032 · Linux+3 · Linux Kernel+3

Hillf Danton · Publicado 2012-04-24 · Atualizado 2023-02-13 · CVE-2012-2133

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.3.6

Description The issue is related to a use-after-free vulnerability in the Linux kernel. When huge pages are enabled, local users can cause a denial of service, potentially leading to a system crash, or possibly gain privileges. This can be achieved by interacting with a hugetlbfs filesystem. An example of triggering this issue is through a umount operation that improperly handles quota data.

Recommendations For Linux kernel versions prior to 3.3.6, update to version 3.3.6 or later to resolve the issue. As a temporary workaround, consider disabling huge pages to minimize the risk of exploitation. Restrict access to hugetlbfs filesystems to reduce the potential for privilege escalation.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

CWE-399

Identificadores relacionados

BDU:2015-01796

CESA-2012_1426

CVE-2012-2133

DSA-2469-1

RHSA-2012:1426

RHSA-2012:1491

RHSA-2012_1426

RHSA-2013:0741

USN-1457-1

USN-1468-1

USN-1469-1

USN-1470-1

USN-1471-1

USN-1472-1

USN-1473-1

USN-1474-1

USN-1476-1

Produtos afetados

Centos

Linux Kernel

Red Hat

Suse

Referências · 33

• https://github.com/torvalds/linux/commit/90481622d75715bfcb68501280a917dbfe516029 · Nota
• https://ubuntu.com/security/notices/USN-1474-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1471-1 · Aviso do Fabricante
• http://debian.org/security/dsa-2469 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0879 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4086 · Nota de Segurança
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=90481622d75715bfcb68501280a917dbfe516029 · Nota
• http://openwall.com/lists/oss-security/2012/04/24 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=817430 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75168 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1601 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2012-2044.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/04/24/12 · Nota
• https://cve.org/CVERecord?id=CVE-2012-2133 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-2133 · Aviso do Fabricante