PT-2012-3080 · Linux+3 · Linux Kernel+3

H. Peter Anvin · Publicado 2012-03-07 · Atualizado 2023-02-13 · CVE-2012-1097

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.2.10

Description The issue is related to the regset feature in the Linux kernel, which does not properly handle the absence of .get and .set methods. This can allow local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE GETREGSET or (2) PTRACE SETREGSET ptrace call.

Recommendations For Linux kernel versions prior to 3.2.10, update to version 3.2.10 or later to resolve the issue.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CESA-2012_0481

CVE-2012-1097

DSA-2443-1

RHSA-2012:0481

RHSA-2012:1042

RHSA-2012_0481

USN-1260-1

USN-1405-1

USN-1406-1

USN-1407-1

USN-1421-1

USN-1422-1

USN-1425-1

USN-1426-1

USN-1431-1

USN-1433-1

USN-1440-1

USN-1446-1

USN-1458-1

Produtos afetados

Centos

Linux Kernel

Red Hat

Suse

Referências · 32

• https://github.com/torvalds/linux/commit/c8e252586f8d5de906385d8cf6385fee289a825e · Correção
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c8e252586f8d5de906385d8cf6385fee289a825e · Nota
• https://ubuntu.com/security/notices/USN-1431-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/03/05/1 · Correção
• https://ubuntu.com/security/notices/USN-1425-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2012-0531.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1446-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1097 · Nota de Segurança
• https://linux.oracle.com/errata/ELSA-2012-2007.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1433-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1406-1 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2012-0481.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1426-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2012-1097 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-1097 · Aviso do Fabricante