CVE-2012-3520
Priority
High
Description
The Netlink implementation in the Linux kernel before 3.2.30 does not
properly handle messages that lack SCM_CREDENTIALS data, which might allow
local users to spoof Netlink communication via a crafted message, as
demonstrated by a message to (1) Avahi or (2) NetworkManager.
properly handle messages that lack SCM_CREDENTIALS data, which might allow
local users to spoof Netlink communication via a crafted message, as
demonstrated by a message to (1) Avahi or (2) NetworkManager.
Ubuntu-Description
Pablo Neira Ayuso discovered a flaw in the credentials of netlink messages.
An unprivileged local attacker could exploit this by getting a netlink
based service, that relies on netlink credentials, to perform privileged
actions.
An unprivileged local attacker could exploit this by getting a netlink
based service, that relies on netlink credentials, to perform privileged
actions.
References
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | released (3.2.0-1609.14) |
| Ubuntu 12.10 (Quantal Quetzal): | not-affected (3.5.0-1601.2) |
| Ubuntu 13.04 (Raring Ringtail): | not-affected |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | ignored (abandoned) |
| Ubuntu 12.04 LTS (Precise Pangolin): | ignored (abandoned) |
| Ubuntu 12.10 (Quantal Quetzal): | ignored (abandoned) |
| Ubuntu 13.04 (Raring Ringtail): | ignored (abandoned) |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | ignored (abandoned) |
| Ubuntu 12.04 LTS (Precise Pangolin): | ignored (abandoned) |
| Ubuntu 12.10 (Quantal Quetzal): | ignored (abandoned) |
| Ubuntu 13.04 (Raring Ringtail): | ignored (abandoned) |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (abandoned) |
| Ubuntu 11.10 (Oneiric Ocelot): | ignored (abandoned) |
| Ubuntu 12.04 LTS (Precise Pangolin): | ignored (abandoned) |
| Ubuntu 12.10 (Quantal Quetzal): | ignored (abandoned) |
| Ubuntu 13.04 (Raring Ringtail): | ignored (abandoned) |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
Package
| Upstream: | DNE |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | not-affected |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
Patches:
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (reached end-of-life) |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (reached end-of-life) |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | not-affected |
| Ubuntu 10.04 LTS (Lucid Lynx): | not-affected |
| Ubuntu 11.10 (Oneiric Ocelot): | not-affected |
| Ubuntu 12.04 LTS (Precise Pangolin): | released (3.2.0-32.51) |
| Ubuntu 12.10 (Quantal Quetzal): | not-affected (3.5.0-15.20) |
| Ubuntu 13.04 (Raring Ringtail): | not-affected (3.5.0-15.20) |
Patches:
| Introduced by 16e5726269611b71c930054ffe9b858c1cea88eb | Fixed by e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | not-affected |
| Ubuntu 12.04 LTS (Precise Pangolin): | released (3.2.0-1420.27) |
| Ubuntu 12.10 (Quantal Quetzal): | not-affected (3.5.0-15.20) |
| Ubuntu 13.04 (Raring Ringtail): | not-affected (3.5.0-15.20) |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | DNE |
| Ubuntu 11.10 (Oneiric Ocelot): | ignored (abandoned) |
| Ubuntu 12.04 LTS (Precise Pangolin): | ignored (abandoned) |
| Ubuntu 12.10 (Quantal Quetzal): | ignored (abandoned) |
| Ubuntu 13.04 (Raring Ringtail): | ignored (abandoned) |
Package
| Upstream: | released (3.6~rc3) |
| Ubuntu 8.04 LTS (Hardy Heron): | DNE |
| Ubuntu 10.04 LTS (Lucid Lynx): | ignored (reached end-of-life, does not affect buildd) |
| Ubuntu 11.10 (Oneiric Ocelot): | DNE |
| Ubuntu 12.04 LTS (Precise Pangolin): | DNE |
| Ubuntu 12.10 (Quantal Quetzal): | DNE |
| Ubuntu 13.04 (Raring Ringtail): | DNE |