Linux Kernel 2.2/2.4 - Ptrace/Setuid Exec Privilege Escalation

🗓️ 18 Oct 2001 00:00:00Reported by Rafal WojtczukType

Linux Kernel vulnerability allows privilege escalation through exec and ptrace abuse by traced processes.

Reporter	Title	Published	Views	Family All 31
BDU FSTEC	The vulnerability of the Red Hat Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Red Hat Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of the Red Hat Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec

source: https://www.securityfocus.com/bid/3447/info

Linux contains a vulnerability in it's exec() implementation that may allow for modification of setuid process memory via ptrace(). The vulnerability is due to the fact that it is possible for a traced process to exec() a setuid image if the tracing process is setuid.

Attackers can exploit this to elevate privileges.

Note: There are currently conflicting reports about the exploitability of this vulnerability.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21124.tgz

23 Sep 2012 00:00Current

7.4High risk

Vulners AI Score7.4

CVSS 27.2

EPSS0.00963