SystemTap MODPROBE_OPTIONS Privilege Escalation

vendor:

by:

Tavis Ormandy, bcoles

N/A

CVSS

N/A

Privilege Escalation

CWE

Product Name:

Affected Version From:

Affected Version To:

Patch Exists:

Related CWE: CVE-2010-4170

CPE:

Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0894/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0895/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2010-4170/

Other Scripts:

Platforms Tested: Linux

2010

SystemTap MODPROBE_OPTIONS Privilege Escalation

This module attempts to gain root privileges by exploiting a vulnerability in the `staprun` executable included with SystemTap version 1.3. The `staprun` executable does not clear environment variables prior to executing `modprobe`, allowing an arbitrary configuration file to be specified in the `MODPROBE_OPTIONS` environment variable, resulting in arbitrary command execution with root privileges. This module has been tested successfully on systemtap 1.2-1.fc13-i686 on Fedora 13 (i686); and systemtap 1.1-3.el5 on RHEL 5.5 (x64).

Mitigation:

Source

SystemTap MODPROBE_OPTIONS Privilege Escalation

Mitigation:

Exploit-DB raw data: