CVE-2011-1020
Published: 28 February 2011
The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.
From the Ubuntu security team
It was discovered that the /proc filesystem did not correctly handle permission changes when programs executed. A local attacker could hold open files to examine details about programs running with higher privileges, potentially increasing the chances of exploiting additional vulnerabilities.
Priority
Low
Status
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1020
- https://usn.ubuntu.com/usn/usn-1189-1
- https://usn.ubuntu.com/usn/usn-1202-1
- https://usn.ubuntu.com/usn/usn-1205-1
- https://usn.ubuntu.com/usn/usn-1201-1
- https://usn.ubuntu.com/usn/usn-1204-1
- https://usn.ubuntu.com/usn/usn-1203-1
- https://usn.ubuntu.com/usn/usn-1208-1
- https://usn.ubuntu.com/usn/usn-1212-1
- https://usn.ubuntu.com/usn/usn-1211-1
- https://usn.ubuntu.com/usn/usn-1216-1
- https://usn.ubuntu.com/usn/usn-1218-1
- https://usn.ubuntu.com/usn/usn-1256-1
- NVD
- Launchpad
- Debian