Vulnerability in Linux Kernel
CVE-2012-2123
The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.2 (High). Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.004 (33.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 34th percentile — 33.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
Weakness classification (CWE)
References
- rhn.redhat.com/errata/RHSA-2012-0743.html (vendor-advisory, VDB Entry, Third Party Advisory)
- www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3 (Vendor Advisory)
- rhn.redhat.com/errata/RHSA-2012-0670.html (vendor-advisory, VDB Entry, Third Party Advisory)
- www.openwall.com/lists/oss-security/2012/04/20/6 (mailing-list, Mailing List, Third Party Advisory)
- www.debian.org/security/2012/dsa-2469 (vendor-advisory, Third Party Advisory)
- www.securityfocus.com/bid/53166 (VDB Entry, Third Party Advisory, vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (Issue Tracking)
- github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445 (Third Party Advisory)
- www.securitytracker.com/id (VDB Entry, Third Party Advisory, vdb-entry)
- exchange.xforce.ibmcloud.com/vulnerabilities/75043 (VDB Entry, vdb-entry)