PT-2024-37854 · Linux+1 · Linux Kernel+1

Published 2024-08-07 · Updated 2024-10-29 · CVE-2024-6760

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A logic bug in the code disables kernel tracing for setuid programs, allowing unprivileged users to trace and inspect the behavior of setuid programs. This bug may be used by an unprivileged user to read the contents of files to which they would not otherwise have access, such as the local password database.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-6760

FREEBSD-SA-24_06

Affected Products

Freebsd

Linux Kernel

References · 9

• https://osv.dev/vulnerability/CVE-2024-6760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6760 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-24:06.ktrace.asc · Vendor Advisory
• https://twitter.com/cracbot/status/1823600544503763214 · Twitter Post
• https://twitter.com/cracbot/status/1823962938014884245 · Twitter Post
• https://t.me/cvenotify/90344 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240816-0010 · Note
• https://freebsd.org/security/advisories/FreeBSD-SA-24:06.ktrace.asc · Note
• https://twitter.com/cracbot/status/1824325335053373598 · Twitter Post