CVE-2012-0056
Priority
Medium
Description
The mem_write function in Linux kernel 2.6.39 and other versions, when ASLR
is disabled, does not properly check permissions when writing to
/proc/<pid>/mem, which allows local users to gain privileges by modifying
process memory, as demonstrated by Mempodipper.
is disabled, does not properly check permissions when writing to
/proc/<pid>/mem, which allows local users to gain privileges by modifying
process memory, as demonstrated by Mempodipper.
Ubuntu-Description
Jüri Aedla discovered that the kernel incorrectly handled /proc/<pid>/mem
permissions. A local attacker could exploit this and gain root privileges.
permissions. A local attacker could exploit this and gain root privileges.
References
Notes
mdeslaur> RH says introduced by 198214a7ee, needs checking.
apw> as the proposed fix actually changes behaviour significantly and the
apw> functionality is very new and thus less likely to be needed it has been
apw> decided to revert 198214a for oneiric (the only release affected) and
apw> monitor it in precise for release.
apw> as the proposed fix actually changes behaviour significantly and the
apw> functionality is very new and thus less likely to be needed it has been
apw> decided to revert 198214a for oneiric (the only release affected) and
apw> monitor it in precise for release.
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | ignored (binary supplied by "linux" now) |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | released (3.0.0-15.26~lucid1) |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | not-affected |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | not-affected |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | not-affected |
| Ubuntu 11.04 (Natty Narwhal): | not-affected |
| Ubuntu 11.10 (Oneiric Ocelot): | released (3.0.0-15.26) |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.2.0-10.18) |
Patches:
| Introduced by 198214a7ee50375fa71a65e518341980cfd4b2f0 | Fixed by e268337dfe26dfc7efd422a804dbb27977a3cccc |
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 10.10 (Maverick Meerkat): | not-affected |
| Ubuntu 11.04 (Natty Narwhal): | not-affected |
| Ubuntu 11.10 (Oneiric Ocelot): | released (3.0.0-1207.16) |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected (3.2.0-1406.8) |
Package
| Upstream: | released (3.3~rc1) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 10.10 (Maverick Meerkat): | DNE |
| Ubuntu 11.04 (Natty Narwhal): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |