Vulnerability Description
The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 3.0.24 |
| Redhat | Enterprise Linux | 4.0 |
| Redhat | Enterprise Mrg | 2.0 |
| Suse | Linux Enterprise Desktop | 11 |
| Suse | Linux Enterprise High Availability Extension | 11 |
| Suse | Linux Enterprise Server | 11 |
Related Weaknesses (CWE)
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=
- http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.htmlMailing ListThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0481.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2012-0531.htmlThird Party Advisory
- http://secunia.com/advisories/48842Broken Link
- http://secunia.com/advisories/48898Broken Link
- http://secunia.com/advisories/48964Broken Link
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10Mailing ListPatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2012/03/05/1Mailing ListPatchThird Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=799209Issue TrackingPatchThird Party Advisory
- https://github.com/torvalds/linux/commit/c8e252586f8d5de906385d8cf6385fee289a825PatchThird Party Advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=
- http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.htmlMailing ListThird Party Advisory
FAQ
What is CVE-2012-1097?
CVE-2012-1097 is a vulnerability with a CVSS score of 7.8 (HIGH). The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL point...
How severe is CVE-2012-1097?
CVE-2012-1097 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2012-1097?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Redhat Enterprise Linux, Redhat Enterprise Mrg, Suse Linux Enterprise Desktop, Suse Linux Enterprise High Availability Extension.