CVE-2012-2123

The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d52fc5dde171f030170a6cb78034d166b13c9445	Broken Link
http://rhn.redhat.com/errata/RHSA-2012-0670.html	Third Party Advisory VDB Entry
http://rhn.redhat.com/errata/RHSA-2012-0743.html	Third Party Advisory VDB Entry
http://www.debian.org/security/2012/dsa-2469	Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3	Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/04/20/6	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/53166	Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1027072	Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=806722	Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/75043	VDB Entry
https://github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2012-05-17 11:00

Updated : 2023-10-12 14:12

NVD link : CVE-2012-2123

Mitre link : CVE-2012-2123

CVE.ORG link : CVE-2012-2123

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-2123", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-05-17T11:00:38.367", "references": [{"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d52fc5dde171f030170a6cb78034d166b13c9445", "tags": ["Broken Link"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2012-0670.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2012-0743.html", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://www.debian.org/security/2012/dsa-2469", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2012/04/20/6", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/53166", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "http://www.securitytracker.com/id?1027072", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=806722", "tags": ["Issue Tracking"], "source": "secalert@redhat.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75043", "tags": ["VDB Entry"], "source": "secalert@redhat.com"}, {"url": "https://github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR."}, {"lang": "es", "value": "La funci\u00f3n cap_bprm_set_creds en security/commoncap.c en el n\u00facleo de Linux antes de v3.3.3 no controla correctamente el uso de las capacidades del sistema de archivos (FCAPS aka) para la implementaci\u00f3n de un archivo ejecutable con privilegios, lo cual permite a usuarios locales eludir las restricciones personales a trav\u00e9s de una aplicaci\u00f3n manipulada, como se demuestra por un ataque que utiliza un proceso padre para desactivar ASLR."}], "lastModified": "2023-10-12T14:12:18.073", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78E044CC-A7B5-4457-9CE9-C1B6A2151C9C", "versionEndExcluding": "3.0.29"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1BC85A39-2EFC-4468-9C66-7455CD4EF690", "versionEndExcluding": "3.2.16", "versionStartIncluding": "3.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77EDD976-8BC1-491C-A240-34C0BA4AC31D", "versionEndExcluding": "3.3.3", "versionStartIncluding": "3.3"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}