Improper input validation in Systemtap

CVE-2011-2503

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.004 (36.2th percentile) — read the EPSS interpretation.

Affected products

  • Systemtap — versions 0.2.2, 0.3, 0.4
  • N/a — versions n/a

Weakness classification (CWE)

References