#VU43962 Permissions, Privileges, and Access Controls in Linux kernel - CVE-2011-0006
Published: June 22, 2012 / Updated: August 11, 2020
Vulnerability identifier: #VU43962
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2011-0006
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by leveraging an administrator's addition of an IMA rule for LSM.
Remediation
Install update from vendor's website.
External links
- http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.37
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=867c20265459d30a01b021a9c1e81fb4c5832aa9
- http://www.openwall.com/lists/oss-security/2011/01/06/18
- https://bugzilla.redhat.com/show_bug.cgi?id=667912
- https://github.com/torvalds/linux/commit/867c20265459d30a01b021a9c1e81fb4c5832aa9