CVE-2011-2503

2012-07-2619:55:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2011-2503

systemtap

staprun

runtime tool

privilege escalation

signature validation

module initialization

nvd

6 Medium

AI Score

Confidence

Low

3.7 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

CPENameOperatorVersion
systemtap:systemtapsystemtapeq1.1
systemtap:systemtapsystemtapeq1.2
systemtap:systemtapsystemtapeq0.3
systemtap:systemtapsystemtapeq0.9.5
systemtap:systemtapsystemtapeq0.4
systemtap:systemtapsystemtapeq0.6.2
systemtap:systemtapsystemtapeq0.5.10
systemtap:systemtapsystemtapeq0.8
systemtap:systemtapsystemtapeq0.9
systemtap:systemtapsystemtapeq0.5.14

CPE	Name	Operator	Version
systemtap:systemtap	systemtap	eq	1.1
systemtap:systemtap	systemtap	eq	1.2
systemtap:systemtap	systemtap	eq	0.3
systemtap:systemtap	systemtap	eq	0.9.5
systemtap:systemtap	systemtap	eq	0.4
systemtap:systemtap	systemtap	eq	0.6.2
systemtap:systemtap	systemtap	eq	0.5.10
systemtap:systemtap	systemtap	eq	0.8
systemtap:systemtap	systemtap	eq	0.9
systemtap:systemtap	systemtap	eq	0.5.14