CVE-2013-0871

Published: 17 February 2013

Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.

From the Ubuntu security team

Suleiman Souhlal, Salman Qazi, Aaron Durbin and Michael Davidson discovered a race condition in the Linux kernel's ptrace syscall. An unprivileged local attacker could exploit this flaw to run programs as an administrator.

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0871
• http://www.openwall.com/lists/oss-security/2013/02/15/16
• https://ubuntu.com/security/notices/USN-1736-1
• https://ubuntu.com/security/notices/USN-1737-1
• https://ubuntu.com/security/notices/USN-1738-1
• https://ubuntu.com/security/notices/USN-1739-1
• https://ubuntu.com/security/notices/USN-1740-1
• https://ubuntu.com/security/notices/USN-1741-1
• https://ubuntu.com/security/notices/USN-1742-1
• https://ubuntu.com/security/notices/USN-1743-1
• https://ubuntu.com/security/notices/USN-1744-1
• https://ubuntu.com/security/notices/USN-1745-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1129192