PT-2013-1016 · Linux · Linux Kernel

Mathias Krause · Published 2013-03-14 · Updated 2013-03-18 · CVE-2012-6543

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.6

Description The issue exists in the l2tp ip6 getname function in the Linux kernel due to incorrect return values under certain circumstances. This allows local users to access sensitive information from kernel stack memory using a specially crafted application that utilizes an uninitialized pointer argument. The function does not initialize a certain structure member, which enables the exploitation.

Recommendations For Linux kernel versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the l2tp ip6 getname function until a patch is available. Avoid using uninitialized pointer arguments in applications that utilize this function to minimize the risk of exploitation.

Fix

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

BDU:2014-00076

CVE-2012-6543

Affected Products

Linux Kernel

References · 7

• https://kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2 · Patch
• https://bdu.fstec.ru/vul/2014-00076 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6543 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-6543 · Security Note
• https://github.com/torvalds/linux/commit/04d4fbca1017c11381e7d82acea21dd741e748bc · Note
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=04d4fbca1017c11381e7d82acea21dd741e748bc · Note
• http://openwall.com/lists/oss-security/2013/03/05/13 · Note