The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-rtUpgrade kernel | Apr 1, 2020 | Apr 12, 2019 |
| Debian | — | Upgrade linux | May 29, 2019 | Apr 12, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade kernel-tools-libsUpgrade kernel-debugUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debug-develUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-headersUpgrade kernel-develUpgrade perf | May 30, 2019 | Apr 12, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernel-develUpgrade kernel-toolsUpgrade python-perfUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64 | May 30, 2019 | Apr 12, 2019 |
| Huawei Euleros 2_0_sp5 | — | Upgrade perfUpgrade kernel-tools-libsUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernelUpgrade kernel-develUpgrade kernel-debuginfo | May 1, 2019 | Apr 11, 2019 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | May 16, 2019 | Apr 3, 2019 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rt | Apr 1, 2020 | Apr 12, 2019 |
| Suse | — | Upgrade ocfs2-kmp-defaultUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-ec2-extraUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade kernel-ec2Upgrade kernel-obs-buildUpgrade cluster-network-kmp-defaultUpgrade kernel-ec2-develUpgrade cluster-md-kmp-default | Jun 18, 2019 | Apr 11, 2019 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-4.4.0-1045-awsUpgrade linux-image-4.4.0-1084-awsUpgrade linux-image-4.4.0-1110-raspi2Upgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-150-generic-lpaeUpgrade linux-image-4.4.0-1047-kvmUpgrade linux-image-4.4.0-150-powerpc64-embUpgrade apparmor-profilesUpgrade linux-image-genericUpgrade linux-image-4.4.0-150-genericUpgrade linux-image-4.4.0-1114-snapdragonUpgrade linux-image-awsUpgrade linux-image-virtualUpgrade linux-image-snapdragonUpgrade linux-image-generic-lpaeUpgrade linux-image-4.4.0-150-powerpc64-smpUpgrade linux-image-powerpc-smpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-powerpc64-embUpgrade linux-image-4.4.0-150-powerpc-e500mcUpgrade linux-image-4.4.0-150-powerpc-smpUpgrade linux-image-powerpc64-smpUpgrade linux-image-powerpc-e500mcUpgrade linux-image-raspi2Upgrade linux-image-lowlatency-lts-xenialUpgrade python3-apparmorUpgrade linux-image-4.4.0-150-lowlatency | Jun 5, 2019 | Apr 11, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub