NVD

Id
8008  
Name
CVE-2011-1020  
Description
The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.  
Reject
 
CVSS Version
2  
CVSS Score
2.1  
Severity
Low  
CVSS Base Score
2.1  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2011-02-28  
Modified Date
2012-03-19  
Seq
2011-1020  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
45583 8008 CVE-2011-1020 [oss-security] 20110224 CVE request: kernel: /proc/$pid/ leaks contents across setuid exec  View
45584 8008 CVE-2011-1020 [oss-security] 20110225 Re: CVE request: kernel: /proc/$pid/ leaks contents across setuid exec  View
45585 8008 CVE-2011-1020 20110122 Proc filesystem and SUID-Binaries  View
45586 8008 CVE-2011-1020 8107  View
45587 8008 CVE-2011-1020 http://www.halfdog.net/Security/2011/SuidBinariesAndProcInterface/  View
45588 8008 CVE-2011-1020 46567  View
45589 8008 CVE-2011-1020 kernel-procpid-security-bypass(65693)  View
45590 8008 CVE-2011-1020 [linux-kernel] 20110209 Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec  View
45591 8008 CVE-2011-1020 [linux-kernel] 20110207 [SECURITY] /proc/$pid/ leaks contents across setuid exec  View
45592 8008 CVE-2011-1020 [linux-kernel] 20110208 Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec  View
45593 8008 CVE-2011-1020 [linux-kernel] 20110207 Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec  View
45594 8008 CVE-2011-1020 [linux-kernel] 20110208 Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec  View
45595 8008 CVE-2011-1020 [linux-kernel] 20110207 Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec  View
45596 8008 CVE-2011-1020 [linux-kernel] 20110209 Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34054 JVNDB-2011-004296 Linux kernel の proc ファイルシステム実装における重要な情報を取得される脆弱性 Linux kernel の proc ファイルシステム実装は、このプロセスが setuid プログラムを実行した後、プロセスの /proc ディレクトリツリーへのアクセスを適切に制限しないため、重要な情報を取得される、またはサービス運用妨害 (DoS) 状態となる脆弱性が存在します。 CVE-2011-1020 48927 CVE-2011-1020 8008 2.1 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004296.html 2011-02-28 2012-12-17 View