CVE-2012-2745
published 2012-08-09CVE-2012-2745: The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows…
PriorityP413medium4.7CVSS 2.0
AVLACMAuNCNINAC
EPSS
0.38%
31.1th percentile
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.2.15-1 (bookworm) | linux 3.2.15-1 (bookworm) |
| linux | linux_kernel | <= 3.3.1 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 3.2.15-1 | 3.2.15-1 |
| linux | linux_kernel | >= 0 < 3.2.15-1 | 3.2.15-1 |
| linux | linux_kernel | >= 0 < 3.2.15-1 | 3.2.15-1 |
| linux | linux_kernel | >= 0 < 3.2.15-1 | 3.2.15-1 |
CVSS provenance
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:N/I:N/A:C
osv4.7MEDIUM
vendor_ubuntu6.9MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2012-10-11·CVSS 6.9
CVE-2012-2137 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in how the Linux kernel's KVM (Kernel-based Virtual
Machine) subsystem handled MSI (Message Signaled Interrupts). A local
unprivileged user could exploit this flaw to cause a denial of service or
potentially elevate privileges. (CVE-2012-2137)
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service (panic). (CVE-2012-2745)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you t
Ubuntu
Linux kernel (EC2) vulnerability
vendor_ubuntu·2012-10-05
CVE-2012-2745 Linux kernel (EC2) vulnerability
Title: Linux kernel (EC2) vulnerability
Summary: The system could be made to crash under certain conditions.
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service (panic).
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kern
Ubuntu
Linux kernel (Natty backport) vulnerabilities
vendor_ubuntu·2012-09-19·CVSS 4.7
CVE-2012-2745 [MEDIUM] Linux kernel (Natty backport) vulnerabilities
Title: Linux kernel (Natty backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service (panic). (CVE-2012-2745)
Ben Hutchings reported a flaw in the Linux kernel with some network drivers
that support TSO (TCP segment offload). A local or peer user could exploit
this flaw to to cause a denial of service. (CVE-2012-3412)
Jay Fenlason and Doug Ledford discovered a bug in the Linux kernel
implementation of RDS sockets. A local unprivileged user could potentially
use this flaw to read privileged information from the kernel.
(CVE-2012-3430)
A flaw was discovered in the madvise feature of
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2012-09-14·CVSS 4.7
CVE-2012-2745 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service (panic). (CVE-2012-2745)
Ben Hutchings reported a flaw in the Linux kernel with some network drivers
that support TSO (TCP segment offload). A local or peer user could exploit
this flaw to to cause a denial of service. (CVE-2012-3412)
Jay Fenlason and Doug Ledford discovered a bug in the Linux kernel
implementation of RDS sockets. A local unprivileged user could potentially
use this flaw to read privileged information from the kernel.
(CVE-2012-3430)
A flaw was discovered in the madvise feature of the Linux kernel'
Red Hat
kernel: cred: copy_process() should clear child->replacement_session_keyring
vendor_redhat·2012-07-10·CVSS 4.7
CVE-2012-2745 [MEDIUM] kernel: cred: copy_process() should clear child->replacement_session_keyring
kernel: cred: copy_process() should clear child->replacement_session_keyring
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 5 as they did not include support for
KEYCTL_SESSION_TO_PARENT keyctl IOCTL as introduced in upstream commit ee18d64c.
This issue did not affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux MRG 2 as they already contain the fix.
This issue was addressed in Red Hat Enterprise Linux 6 via RHSA-2012:1064 https://rhn.redh
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2012-05-31·CVSS 4.9
CVE-2012-1601 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual
cpu setup. An unprivileged local user could exploit this flaw to crash the
system leading to a denial of service. (CVE-2012-1601)
Steve Grubb reported a flaw with Linux fscaps (file system base
capabilities) when used to increase the permissions of a process. For
application on which fscaps are in use a local attacker can disable address
space randomization to make attacking the process with raised privileges
easier. (CVE-2012-2123)
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service
Ubuntu
Linux kernel (Oneiric backport) vulnerabilities
vendor_ubuntu·2012-05-30·CVSS 4.9
CVE-2012-1601 [MEDIUM] Linux kernel (Oneiric backport) vulnerabilities
Title: Linux kernel (Oneiric backport) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual
cpu setup. An unprivileged local user could exploit this flaw to crash the
system leading to a denial of service. (CVE-2012-1601)
Steve Grubb reported a flaw with Linux fscaps (file system base
capabilities) when used to increase the permissions of a process. For
application on which fscaps are in use a local attacker can disable address
space randomization to make attacking the process with raised privileges
easier. (CVE-2012-2123)
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2012-05-25·CVSS 4.9
CVE-2012-1601 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual
cpu setup. An unprivileged local user could exploit this flaw to crash the
system leading to a denial of service. (CVE-2012-1601)
Steve Grubb reported a flaw with Linux fscaps (file system base
capabilities) when used to increase the permissions of a process. For
application on which fscaps are in use a local attacker can disable address
space randomization to make attacking the process with raised privileges
easier. (CVE-2012-2123)
A flaw was found in how the Linux kernel passed the replacement session
keyring to a child process. An unprivileged local user could exploit this
flaw to cause a denial of service (panic).
Debian
CVE-2012-2745: linux - The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provid...
vendor_debian·2012·CVSS 4.7
CVE-2012-2745 [MEDIUM] CVE-2012-2745: linux - The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provid...
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
Scope: local
bookworm: resolved (fixed in 3.2.15-1)
bullseye: resolved (fixed in 3.2.15-1)
forky: resolved (fixed in 3.2.15-1)
sid: resolved (fixed in 3.2.15-1)
trixie: resolved (fixed in 3.2.15-1)
GHSA
GHSA-gxmr-6cg7-7q62: The copy_creds function in kernel/cred
ghsa_unreviewed·2022-05-17
CVE-2012-2745 [MEDIUM] CWE-119 GHSA-gxmr-6cg7-7q62: The copy_creds function in kernel/cred
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
OSV
CVE-2012-2745: The copy_creds function in kernel/cred
osv·2012-08-09·CVSS 4.7
CVE-2012-2745 [MEDIUM] CVE-2012-2745: The copy_creds function in kernel/cred
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2012-2745 kernel: cred: copy_process() should clear child->replacement_session_keyring [fedora-all]
bugzilla·2012-07-10·CVSS 4.7
CVE-2012-2745 [MEDIUM] CVE-2012-2745 kernel: cred: copy_process() should clear child->replacement_session_keyring [fedora-all]
CVE-2012-2745 kernel: cred: copy_process() should clear child->replacement_session_keyring [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org
Bugzilla
CVE-2012-2745 kernel: cred: copy_process() should clear child->replacement_session_keyring
bugzilla·2012-06-19·CVSS 4.7
CVE-2012-2745 [MEDIUM] CVE-2012-2745 kernel: cred: copy_process() should clear child->replacement_session_keyring
CVE-2012-2745 kernel: cred: copy_process() should clear child->replacement_session_keyring
keyctl_session_to_parent(task) sets ->replacement_session_keyring, it should be processed and cleared by key_replace_session_keyring().
However, this task can fork before it notices TIF_NOTIFY_RESUME and the new child gets the bogus ->replacement_session_keyring copied by dup_task_struct(). This is obviously wrong and, if nothing else, this
leads to put_cred(already_freed_cred).
This causes the following panic on ppc64:
Kernel panic - not syncing: CRED: put_cred_rcu() sees c0000001f41a4480 with usage -1
Call Trace:
[c0000001fff53bc0] [c000000000012f04] .show_stack+0x74/0x1c0 (unreliable)
[c0000001fff53c70] [c0000000005c2d18] .panic+0xb8/0x1ec
[c0000001fff53d00] [c0000000000c7858] .put_cred_rcu+0x
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=79549c6dfda0603dba9a70a53467ce62d9335c33http://rhn.redhat.com/errata/RHSA-2012-1064.htmlhttp://secunia.com/advisories/50633http://secunia.com/advisories/50853http://secunia.com/advisories/50961http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.2http://www.securityfocus.com/bid/54365http://www.securitytracker.com/id?1027236http://www.ubuntu.com/usn/USN-1567-1http://www.ubuntu.com/usn/USN-1597-1http://www.ubuntu.com/usn/USN-1606-1https://bugzilla.redhat.com/show_bug.cgi?id=833428https://github.com/torvalds/linux/commit/79549c6dfda0603dba9a70a53467ce62d9335c33http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=79549c6dfda0603dba9a70a53467ce62d9335c33http://rhn.redhat.com/errata/RHSA-2012-1064.htmlhttp://secunia.com/advisories/50633http://secunia.com/advisories/50853http://secunia.com/advisories/50961http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.2http://www.securityfocus.com/bid/54365http://www.securitytracker.com/id?1027236http://www.ubuntu.com/usn/USN-1567-1http://www.ubuntu.com/usn/USN-1597-1http://www.ubuntu.com/usn/USN-1606-1https://bugzilla.redhat.com/show_bug.cgi?id=833428https://github.com/torvalds/linux/commit/79549c6dfda0603dba9a70a53467ce62d9335c33
2012-08-09
Published