kernel: no access restrictions of /proc/pid/* after setuid program exec

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...

kernel: /proc/PID/io infoleak

fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc//io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password...

Debian DSA-2303-2 : linux-2.6 - privilege escalation/denial of service/information leak

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service or privilege escalation. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2011-1020 Kees Cook discovered an issue in the /proc filesystem that allows loc...

DSA-2303-1 linux-2.6 - several issues

Bulletin has no description...

Ubuntu Update for linux USN-1189-1

Ubuntu Update for Linux kernel vulnerabilities USN-1189-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN11891.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for linux USN-1189-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This...

Ubuntu 8.04 LTS : linux vulnerabilities (USN-1189-1)

It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities...

SuSE 11.1 Security Update : Linux kernel (SAT Patch Numbers 4884 / 4888 / 4889)

The SUSE Linux Enterprise 11 Service Pack 1 kernel was updated to 2.6.32.43 and fixes various bugs and security issues. The following security issues were fixed : - The normal mmap paths all avoid creating a mapping where the pgoff inside the mapping could wrap around due to overflow. However, an...

Ubuntu 10.10 : linux vulnerabilities (USN-1160-1)

Dan Rosenberg discovered that IRDA did not correctly check the size of buffers. On non-x86 systems, a local attacker could exploit this to read kernel heap memory, leading to a loss of privacy. CVE-2010-4529 Dan Rosenburg discovered that the CAN subsystem leaked kernel addresses into the /proc...

CVE-2011-1020

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...

Directory traversal

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...

CVE-2011-1020

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lsee...

Linux Daemons with Broken Links to Executables

By examining the '/proc' filesystem on the remote Linux host, Nessus has identified at least one currently-running daemon for which the link to the corresponding executable is broken. This can occur when the executable associated with a daemon is replaced on disk but the daemon itself has not bee...

kernel: fs: pipe.c null pointer dereference

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service NULL pointer dereference and system crash or gain privileges by attempting to open an anonymous pipe via a /proc//fd/ pathname...

kernel: fs: pipe.c null pointer dereference

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service NULL pointer dereference and system crash or gain privileges by attempting to open an anonymous pipe via a /proc//fd/ pathname...

kernel: /proc/$pid/maps visible during initial setuid ELF loading

The mmformaps function in fs/proc/base.c in the Linux kernel 2.6.30.4 and earlier allows local users to read 1 maps and 2 smaps files under proc/ via vectors related to ELF loading, a setuid process, and a race condition...

PT-2009-5837

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.32-rc6 Description The issue is related to multiple race conditions in the fs/pipe.c file of the Linux kernel. This can be exploited by local users to cause a denial of service, resulting in a NULL pointer...

proc File Descriptors Directory Permissions bypass

No description provided by source. Hi! This is forward from lkml, so no, I did not invent this hole. Unfortunately, I do not think lkml sees this as a security hole, so... Jamie Lokier said: a the current permission model under /proc/PID/fd has a security hole which Jamie is worried about I belie...

proc File Descriptors Directory Permissions bypass

Exploit for unknown platform in category local exploits ================================================== proc File Descriptors Directory Permissions bypass ================================================== Title: proc File Descriptors Directory Permissions bypass CVE-ID: OSVDB-ID: Author: Pave...

/proc Filesystem Directory Permission Bypass

Hi! This is forward from lkml, so no, I did not invent this hole. Unfortunately, I do not think lkml sees this as a security hole, so... Jamie Lokier said: a the current permission model under /proc/PID/fd has a security hole which Jamie is worried about I believe its bugtraq time. Being able to...

proc File - Descriptors Directory Permissions Bypass

proc File - Descriptors Directory Permissions Bypass Hi! This is forward from lkml, so no, I did not invent this hole. Unfortunately, I do not think lkml sees this as a security hole, so... Jamie Lokier said: a the current permission model under /proc/PID/fd has a security hole which Jamie is...