CVE-2010-4170 The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment var...
HighCVSS 7.2
EPSS 5.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| systemtap | = 1.3 | No fix listed |
| debian/systemtap(Debian:12) | < 1.2-3 | 1.2-3 |
| debian/systemtap(Debian:13) | < 1.2-3 | 1.2-3 |
| debian/systemtap(Debian:14) | < 1.2-3 | 1.2-3 |
References
- Debian Security Tracker CVE-2010-4170 vendor-advisory
- bugs.debian.org issue-tracking
- FEDORA-2010-17865 vendor-advisory
- FEDORA-2010-17868 vendor-advisory
- FEDORA-2010-17873 vendor-advisory
- packetstormsecurity.com
- 42256 third-party-advisory vendor-advisory
- 42263 third-party-advisory vendor-advisory
- 42306 third-party-advisory vendor-advisory
- 42318 third-party-advisory vendor-advisory
- 46920 third-party-advisory
- sources.redhat.com
- [systemtap] 20101117 important systemtap security fix mailing-list
- DSA-2348 vendor-advisory
- 15620 exploit
- RHSA-2010:0894 vendor-advisory
- RHSA-2010:0895 vendor-advisory
- 44914 exploit vdb-entry
- 1024754 vdb-entry
- systemtap-staprun-priv-escalation(63344) vdb-entry
- 46730 exploit