|
|
|
Vulnerability Note VU#628849ptrace contains vulnerability allowing for local root compromiseOverviewA vulnerability in the Linux 2.2 and 2.4 distributions of ptrace() may permit a local attacker to gain elevated privileges.I. DescriptionThe Linux 2.2 and 2.4 kernels contained a flaw in ptrace(). This vulnerability may permit a local user to have the kernel spawn a child process. From the man page:The ptrace system call provides a means by which a parent process may observe and control the execution of another process, and examine and change its core image and registers. It is primarily used to implement breakpoint debugging and system call tracing. If the kernel is built with modules and kernel module loader enabled and /proc/sys/kernel/modprobe contains the path to a valid executable and ptrace() calls are not blocked, then a local user may be able to exploit this vulnerability to gain root privileges to the system. The CERT/CC has seen active exploitation of this vulnerability. II. ImpactA local user can exploit this vulnerability to gain elevated privileges, typically root.III. SolutionThis vulnerability has been resolved in Linux 2.2.25 and 2.4.21. Various vendors have also released advisories and updates. Please see the your vendor's advisory for more details.
References
Thanks to Andrzej Szombierski for reporting this vulnerability. This document was written by Jason A Rafail and is based on information provided by Andrzej Szombierski.
If you have feedback, comments, or additional information about this vulnerability, please send us
email. |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Get Adobe Reader