SB2014020518 - Permissions, Privileges, and Access Controls in SystemTap

Description

This security bulletin contains information about 1 vulnerability.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-0875)

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer.

Remediation

Install update from vendor's website.

References

• http://lists.opensuse.org/opensuse-updates/2013-03/msg00057.html
• http://permalink.gmane.org/gmane.comp.security.oss.general/6987
• http://rhn.redhat.com/errata/RHSA-2012-0376.html
• http://securitytracker.com/id?1026777
• http://sourceware.org/bugzilla/show_bug.cgi?id=13714
• http://sourceware.org/git/?p=systemtap.git;a=commit;h=64b0cff3b