PT-2012-6296 · Linux+2 · Linux Kernel+2

Florian Weimer · Published 2012-12-31 · Updated 2023-01-20 · CVE-2012-6689

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.5.5

Description The issue concerns the netlink sendmsg function in the Linux kernel, which fails to validate the dst pid field. This allows local users to potentially spoof Netlink messages, although the exact impact is not specified.

Recommendations For Linux kernel versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CESA-2014_1392

CVE-2012-6689

DLA-246-1

RHSA-2014:1392

RHSA-2014_1392

USN-1599-1

USN-1610-1

Affected Products

Centos

Linux Kernel

Red Hat

References · 228

• 🔥 https://github.com/hiikezoe/libfb_mem_exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-6689 · Security Note
• https://bdu.fstec.ru/vul/2015-05784 · Security Note
• https://bdu.fstec.ru/vul/2015-05817 · Security Note
• https://bdu.fstec.ru/vul/2015-05685 · Security Note
• https://bdu.fstec.ru/vul/2015-05804 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5077 · Security Note
• https://bdu.fstec.ru/vul/2015-05769 · Security Note
• https://bdu.fstec.ru/vul/2015-05821 · Security Note
• https://bdu.fstec.ru/vul/2015-05743 · Security Note
• https://bdu.fstec.ru/vul/2015-05809 · Security Note
• https://bdu.fstec.ru/vul/2015-05742 · Security Note
• https://bdu.fstec.ru/vul/2015-05831 · Security Note
• https://bdu.fstec.ru/vul/2015-05811 · Security Note
• https://bdu.fstec.ru/vul/2015-05798 · Security Note