NVD

Id
43972  
Name
CVE-2012-2123  
Description
The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2012-05-17  
Modified Date
2013-02-14  
Seq
2012-2123  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
220955 43972 CVE-2012-2123 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d52fc5dde171f030170a6cb78034d166b13c9445  View
220956 43972 CVE-2012-2123 RHSA-2012:0743  View
220957 43972 CVE-2012-2123 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3  View
220958 43972 CVE-2012-2123 [oss-security] 20120419 Re: CVE request: kernel: fcaps: clear the same personality flags as suid when fcaps are used  View
220959 43972 CVE-2012-2123 53166  View
220960 43972 CVE-2012-2123 1027072  View
220961 43972 CVE-2012-2123 linux-kernel-fcaps-sec-bypass(75043)  View
220962 43972 CVE-2012-2123 https://bugzilla.redhat.com/show_bug.cgi?id=806722  View
220963 43972 CVE-2012-2123 https://github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
26750 JVNDB-2012-002457 Linux kernel の cap_bprm_set_creds 関数におけるパーソナリティ (personality) の制限を回避される脆弱性 Linux kernel の security/commoncap.c 内の cap_bprm_set_creds 関数は、特権を持つ実行ファイルを実行するためのファイルシステム機能 (fcaps) の使用を適切に処理しないため、パーソナリティ (personality) の制限を回避される脆弱性が存在します。 CVE-2012-2123 55361 CVE-2012-2123 43972 7.2 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-002457.html 2012-05-17 2012-05-18 View