The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemtap-initscriptUpgrade systemtap-testsuiteUpgrade systemtapUpgrade systemtap-serverUpgrade systemtap-runtimeUpgrade systemtap-clientUpgrade systemtap-sdt-devel | Dec 1, 2016 | Dec 7, 2010 |
| Debian | — | Upgrade systemtap | Jul 30, 2024 | Dec 7, 2010 |
| Oracle_linux | — | Upgrade systemtap-clientUpgrade systemtapUpgrade systemtap-runtimeUpgrade systemtap-sdt-develUpgrade systemtap-serverUpgrade systemtap-testsuiteUpgrade systemtap-initscriptUpgrade systemtap-grapher | Oct 16, 2024 | Dec 7, 2010 |
| Ubuntu | — | Upgrade systemtap | Nov 19, 2024 | Dec 7, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub