Описание
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
Ссылки
- PatchThird Party Advisory
- PatchThird Party Advisory
- ExploitMailing ListThird Party Advisory
- ExploitMailing ListThird Party Advisory
- PatchThird Party Advisory
- PatchThird Party Advisory
Уязвимые конфигурации
EPSS
4.7 Medium
CVSS3
4.7 Medium
CVSS2
Дефекты
Связанные уязвимости
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
The Linux kernel before 4.8 allows local users to bypass ASLR on setui ...
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
Уязвимость функции load_elf_binary() ядра операционной системы Linux, позволяющая нарушителю обойти механизм защиты ASLR и раскрыть защищаемую информацию
EPSS
4.7 Medium
CVSS3
4.7 Medium
CVSS2