CVE-2012-2123

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-2123
The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d52fc5dde171f030170a6cb78034d166b13c9445 Broken Link
http://rhn.redhat.com/errata/RHSA-2012-0670.html Third Party Advisory VDB Entry
http://rhn.redhat.com/errata/RHSA-2012-0743.html Third Party Advisory VDB Entry
http://www.debian.org/security/2012/dsa-2469 Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3 Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/04/20/6 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/53166 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1027072 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=806722 Issue Tracking
https://exchange.xforce.ibmcloud.com/vulnerabilities/75043 VDB Entry
https://github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

12 Oct 2023, 14:12

Type Values Removed Values Added
References (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=806722 - (CONFIRM) https://bugzilla.redhat.com/show_bug.cgi?id=806722 - Issue Tracking
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0670.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0670.html - Third Party Advisory, VDB Entry
References (CONFIRM) https://github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445 - (CONFIRM) https://github.com/torvalds/linux/commit/d52fc5dde171f030170a6cb78034d166b13c9445 - Third Party Advisory
References (MISC) http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d52fc5dde171f030170a6cb78034d166b13c9445 - (MISC) http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d52fc5dde171f030170a6cb78034d166b13c9445 - Broken Link
References (CONFIRM) http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3 - (CONFIRM) http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.3 - Vendor Advisory
References (SECTRACK) http://www.securitytracker.com/id?1027072 - (SECTRACK) http://www.securitytracker.com/id?1027072 - Third Party Advisory, VDB Entry
References (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/75043 - (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/75043 - VDB Entry
References (MLIST) http://www.openwall.com/lists/oss-security/2012/04/20/6 - (MLIST) http://www.openwall.com/lists/oss-security/2012/04/20/6 - Mailing List, Third Party Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0743.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2012-0743.html - Third Party Advisory, VDB Entry
References (BID) http://www.securityfocus.com/bid/53166 - (BID) http://www.securityfocus.com/bid/53166 - Third Party Advisory, VDB Entry
References (DEBIAN) http://www.debian.org/security/2012/dsa-2469 - (DEBIAN) http://www.debian.org/security/2012/dsa-2469 - Third Party Advisory

13 Feb 2023, 00:24

Type Values Removed Values Added
References
  • {'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d52fc5dde171f030170a6cb78034d166b13c9445', 'name': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d52fc5dde171f030170a6cb78034d166b13c9445', 'tags': [], 'refsource': 'CONFIRM'}
  • (MISC) http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d52fc5dde171f030170a6cb78034d166b13c9445 -
Information

Published : 2012-05-17 11:00

Updated : 2023-12-10 11:16

NVD link : CVE-2012-2123

Mitre link : CVE-2012-2123

CVE.ORG link : CVE-2012-2123

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-264

Permissions, Privileges, and Access Controls