The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemtap-testsuiteUpgrade systemtap-sdt-develUpgrade systemtapUpgrade systemtap-serverUpgrade systemtap-initscriptUpgrade systemtap-runtimeUpgrade systemtap-client | Dec 1, 2016 | Dec 7, 2010 |
| Debian | — | Upgrade systemtap | Jul 30, 2024 | Dec 7, 2010 |
| Oracle_linux | — | Upgrade systemtapUpgrade systemtap-clientUpgrade systemtap-serverUpgrade systemtap-grapherUpgrade systemtap-testsuiteUpgrade systemtap-initscriptUpgrade systemtap-sdt-develUpgrade systemtap-runtime | Oct 16, 2024 | Dec 7, 2010 |
| Ubuntu | — | Upgrade systemtap | Nov 19, 2024 | Dec 7, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub