#VU43443 Information disclosure in Linux kernel - CVE-2012-3430

Vulnerability identifier: #VU43443

Vulnerability risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2012-3430

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0.1 - 3.0.42

---

External links
https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=06b6a1cf6e776426766298d055bb3991957d90a7
https://rhn.redhat.com/errata/RHSA-2012-1323.html
https://secunia.com/advisories/50633
https://secunia.com/advisories/50732
https://secunia.com/advisories/50811
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.0.44
https://www.openwall.com/lists/oss-security/2012/07/26/5
https://www.ubuntu.com/usn/USN-1567-1
https://www.ubuntu.com/usn/USN-1568-1
https://www.ubuntu.com/usn/USN-1572-1
https://www.ubuntu.com/usn/USN-1575-1
https://www.ubuntu.com/usn/USN-1577-1
https://www.ubuntu.com/usn/USN-1578-1
https://www.ubuntu.com/usn/USN-1579-1
https://www.ubuntu.com/usn/USN-1580-1
https://bugzilla.redhat.com/show_bug.cgi?id=820039
https://github.com/torvalds/linux/commit/06b6a1cf6e776426766298d055bb3991957d90a7
https://www.suse.com/support/update/announcement/2012/suse-su-20121679-1.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.