The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade systemtap-runtimeUpgrade systemtap-clientUpgrade systemtap-serverUpgrade systemtap-sdt-develUpgrade systemtap-testsuiteUpgrade systemtap-initscriptUpgrade systemtap | Dec 1, 2016 | Dec 7, 2010 |
| Debian | — | Upgrade systemtap | Jul 30, 2024 | Dec 7, 2010 |
| Oracle_linux | — | Upgrade systemtap-clientUpgrade systemtapUpgrade systemtap-testsuiteUpgrade systemtap-grapherUpgrade systemtap-serverUpgrade systemtap-runtimeUpgrade systemtap-sdt-develUpgrade systemtap-initscript | Oct 16, 2024 | Dec 7, 2010 |
| Ubuntu | — | Upgrade systemtap | Nov 19, 2024 | Dec 7, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub