PT-2012-1190 · Linux+2 · Linux Kernel+2

Yurij M. Plotnikov · Publicado 2012-07-04 · Atualizado 2023-02-13 · CVE-2012-3375

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.2.24

Description The epoll ctl system call in fs/eventpoll.c does not properly handle ELOOP errors in EPOLL CTL ADD operations, allowing local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. This issue exists due to an incorrect fix for a previous problem.

Recommendations For Linux kernel versions prior to 3.2.24, update to version 3.2.24 or later to resolve the issue. As a temporary workaround, consider restricting the use of the epoll ctl system call to minimize the risk of exploitation. Avoid using crafted applications that attempt to create circular epoll dependencies until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

BDU:2016-02217

CVE-2012-3375

RHSA-2012:1061

RHSA-2012:1150

RHSA-2012_1061

SUSE-SU-2012_1016-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0652-1

USN-1514-1

USN-1529-1

USN-1532-1

USN-1533-1

USN-1539-1

Produtos afetados

Linux Kernel

Red Hat

Suse

Referências · 27

• 🔥 https://github.com/torvalds/linux/commit/13d518074a952d33d47c428419693f63389547e9 · Exploit
• 🔥 https://exploit-db.com/exploits/19605 · Exploit
• http://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24 · Nota
• https://ubuntu.com/security/CVE-2012-3375 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2012-2026.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/07/04 · Nota
• https://ubuntu.com/security/notices/USN-1514-1 · Aviso do Fabricante
• http://securitytracker.com/id?1027237 · Nota
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d518074a952d33d47c428419693f63389547e9 · Nota
• https://downloads.avaya.com/css/P8/documents/100165733 · Nota
• https://cve.org/CVERecord?id=CVE-2012-3375 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-1529-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-3375 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-02217 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2012-3375 · Aviso do Fabricante