Veracode Vulnerability DatabaseVERACODE:11334Information Disclosure
EPSS
Percentile
0.4%
kernel-rt is vulnerable to information disclosure attacks. The vulnerability exists as the override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.
References
git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2702b1526c7278c4d65d78de209a465d4de2885e
lists.fedoraproject.org/pipermail/package-announce/2012-November/091110.html
secunia.com/advisories/51409
www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.16
www.openwall.com/lists/oss-security/2012/10/09/4
www.ubuntu.com/usn/USN-1644-1
www.ubuntu.com/usn/USN-1645-1
www.ubuntu.com/usn/USN-1646-1
www.ubuntu.com/usn/USN-1647-1
www.ubuntu.com/usn/USN-1648-1
www.ubuntu.com/usn/USN-1649-1
www.ubuntu.com/usn/USN-1652-1
access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_MRG/2/html/Technical_Notes/sec-Red_Hat_Enterprise_Linux_6.html#RHSA-2012-1491
access.redhat.com/security/updates/classification/#important
bugzilla.redhat.com/show_bug.cgi?id=843130
bugzilla.redhat.com/show_bug.cgi?id=856243
bugzilla.redhat.com/show_bug.cgi?id=859226
bugzilla.redhat.com/show_bug.cgi?id=862877
bugzilla.redhat.com/show_bug.cgi?id=864568
github.com/torvalds/linux/commit/2702b1526c7278c4d65d78de209a465d4de2885e
rhn.redhat.com/errata/RHSA-2012-1491.html
Related
