The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemtap-clientUpgrade systemtap-sdt-develUpgrade systemtapUpgrade systemtap-initscriptUpgrade systemtap-serverUpgrade systemtap-testsuiteUpgrade systemtap-runtime | Dec 1, 2016 | Dec 7, 2010 |
| Debian | — | Upgrade systemtap | Jul 30, 2024 | Dec 7, 2010 |
| Oracle_linux | — | Upgrade systemtap-sdt-develUpgrade systemtap-testsuiteUpgrade systemtap-serverUpgrade systemtap-runtimeUpgrade systemtap-initscriptUpgrade systemtap-grapherUpgrade systemtapUpgrade systemtap-client | Oct 16, 2024 | Dec 7, 2010 |
| Ubuntu | — | Upgrade systemtap | Nov 19, 2024 | Dec 7, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub