CVE-2012-0957

Published: 10 October 2012

The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.

From the Ubuntu security team

Brad Spengler discovered a flaw in the Linux kernel's uname system call. An unprivileged user could exploit this flaw to read kernel stack memory.

Notes

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1060521

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0957
• https://lkml.org/lkml/2012/10/9/550
• https://ubuntu.com/security/notices/USN-1644-1
• https://ubuntu.com/security/notices/USN-1645-1
• https://ubuntu.com/security/notices/USN-1646-1
• https://ubuntu.com/security/notices/USN-1647-1
• https://ubuntu.com/security/notices/USN-1648-1
• https://ubuntu.com/security/notices/USN-1649-1
• https://ubuntu.com/security/notices/USN-1652-1
• https://ubuntu.com/security/notices/USN-1704-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1065622