PT-2012-4232 · Linux+3 · Linux Kernel+3

Petr Matousek · Published 2012-07-10 · Updated 2023-02-13 · CVE-2012-2745

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.3.2

Description The issue allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call. This is due to the copy creds function in kernel/cred.c providing an invalid replacement session keyring to a child process.

Recommendations For versions prior to 3.3.2, update to version 3.3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the fork system call in sensitive applications until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2012_1064

CVE-2012-2745

OPENSUSE-SU-2013_0396-1

RHSA-2012:1064

RHSA-2012_1064

SUSE-SU-2012_1350-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0652-1

USN-1448-1

USN-1452-1

USN-1455-1

USN-1459-1

USN-1460-1

USN-1567-1

USN-1574-1

USN-1597-1

USN-1606-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

References · 32

• https://github.com/torvalds/linux/commit/79549c6dfda0603dba9a70a53467ce62d9335c33 · Patch
• https://ubuntu.com/security/notices/USN-1574-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2745 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2745 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1597-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2012-2026.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1460-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1606-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1459-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2012-1064.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-2745 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1606-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1448-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2745 · Vendor Advisory
• http://ubuntu.com/usn/USN-1567-1 · Vendor Advisory