PT-2012-1190 · Linux+2 · Linux Kernel+2

Yurij M. Plotnikov · Published 2012-07-04 · Updated 2023-02-13 · CVE-2012-3375

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.2.24

Description The epoll ctl system call in fs/eventpoll.c does not properly handle ELOOP errors in EPOLL CTL ADD operations, allowing local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. This issue exists due to an incorrect fix for a previous problem.

Recommendations For Linux kernel versions prior to 3.2.24, update to version 3.2.24 or later to resolve the issue. As a temporary workaround, consider restricting the use of the epoll ctl system call to minimize the risk of exploitation. Avoid using crafted applications that attempt to create circular epoll dependencies until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2016-02217

CVE-2012-3375

RHSA-2012:1061

RHSA-2012:1150

RHSA-2012_1061

SUSE-SU-2012_1016-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0652-1

USN-1514-1

USN-1529-1

USN-1532-1

USN-1533-1

USN-1539-1

Affected Products

Linux Kernel

Red Hat

Suse

References · 27

• 🔥 https://github.com/torvalds/linux/commit/13d518074a952d33d47c428419693f63389547e9 · Exploit
• 🔥 https://exploit-db.com/exploits/19605 · Exploit
• https://ubuntu.com/security/CVE-2012-3375 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-2026.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1514-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-3375 · Security Note
• https://ubuntu.com/security/notices/USN-1529-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3375 · Security Note
• https://bdu.fstec.ru/vul/2016-02217 · Security Note
• https://osv.dev/vulnerability/CVE-2012-3375 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3375 · Vendor Advisory
• http://ubuntu.com/usn/usn-1529-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3375 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1533-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1539-1 · Vendor Advisory