PT-2012-6296 · Linux+2 · Linux Kernel+2

Florian Weimer · CVE-2012-6689 · Publicado 2012-12-31 · Atualizado 2023-01-20

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.5.5

Description The issue concerns the netlink sendmsg function in the Linux kernel, which fails to validate the dst pid field. This allows local users to potentially spoof Netlink messages, although the exact impact is not specified.

Recommendations For Linux kernel versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CESA-2014_1392

CVE-2012-6689

DLA-246-1

RHSA-2014:1392

RHSA-2014_1392

USN-1599-1

USN-1610-1

Produtos afetados

Centos

Linux Kernel

Red Hat

Referências · 228

• 🔥 https://github.com/hiikezoe/libfb_mem_exploit · Exploit
• https://github.com/torvalds/linux/commit/350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7 · Nota
• https://github.com/torvalds/linux/commit/295dc39d941dc2ae53d5c170365af4c9d5c16212 · Nota
• https://github.com/torvalds/linux/commit/6062a8dc0517bce23e3c2f7d2fea5e22411269a3 · Nota
• https://github.com/torvalds/linux/commit/20e1db19db5d6b9e4e83021595eab0dc8f107bef · Nota
• https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-6689 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-05784 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-05817 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-05685 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-05804 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077 · Nota de Segurança
• http://marc.info/?l=linux-netdev&m=134522422125983&w=2 · Nota
• https://access.redhat.com/security/cve/CVE-2014-4653 · Nota
• https://bdu.fstec.ru/vul/2015-05769 · Nota de Segurança