Linux Kernel local privilege escalation via SUID /proc/pid/mem write

Overview

Linux kernel >= 2.6.39 incorrectly handles the permissions for /proc/<pid>/mem. A local, authenticated attacker could exploit this vulnerability to escalate to root privileges. Exploit code is available in the wild and there have been reports of active exploitation.

Description

/proc/<pid>/mem is an interface for reading and writing to process memory. The protections to protect unprivileged users from writing to process memory were found to be insufficient and have resulted in exploitation of the interface. By writing to the memory of a suid process, an attacker can run arbitrary code with root privileges. Further technical details can be found on Jason A. Donenfeld’s ZX2C4 blog post.

Impact

A local, authenticated attacker may be able to gain root privileges on the system.

Solution

Apply an update
Patch commit e268337dfe26dfc7efd422a804dbb27977a3cccc has been provided by Linus Torvalds to address this vulnerability. Kernel image 3.0.18 and 3.2.2 have included this commit so far.Users who obtain the Linux kernel from a third-party vendor, such as their operating system vendor, should see the vendor information portion of this document for a partial list of affected vendors.

Vendor Information

470151

Filter by status: All Affected Not Affected Unknown

Filter by content: __Additional information available

__Sort by: Status Alphabetical

Expand all

Javascript is disabled. Clickhere to view vendors.

CentOS Affected

Updated: January 27, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Gentoo Linux Affected

Updated: January 28, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• http://www.gentoo.org/security/en/glsa/index.xml

Red Hat, Inc. Affected

Updated: January 27, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• https://access.redhat.com/kb/docs/DOC-69129
• https://rhn.redhat.com/errata/RHSA-2012-0052.html
• https://bugzilla.redhat.com/show_bug.cgi?id=782642
• https://www.redhat.com/security/data/cve/CVE-2012-0056.html

Ubuntu Affected

Updated: January 27, 2012

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• http://www.ubuntu.com/usn/usn-1342-1/

Debian GNU/Linux __ Not Affected

Updated: January 27, 2012

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The stable branch of Debian is unaffected because it uses an earlier version of the kernel that does not include the vulnerable code.

SUSE Linux Unknown

Updated: January 27, 2012

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• http://www.suse.com/support/security/advisories/

Slackware Linux Inc. Unknown

Updated: January 27, 2012

Status

Unknown

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

Vendor References

• http://www.slackware.com/security/

CVSS Metrics

Group	Score	Vector
Base	6.8	AV:L/AC:L/Au:S/C:C/I:C/A:C
Temporal	5.6	E:F/RL:OF/RC:C
Environmental	5.6	CDP:ND/TD:H/CR:ND/IR:ND/AR:ND

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc
• http://blog.zx2c4.com/749
• http://www.outflux.net/blog/archives/2012/01/22/fixing-vulnerabilities-with-systemtap/

Acknowledgements

Jüri Aedla reported this vulnerability to the Linux kernel developers.

This document was written by Jared Allar.

Other Information

CVE IDs:	CVE-2012-0056
Severity Metric:	15.32 Date Public: