Linux Kernel 'uname()' System Call Local Information Disclosure Vulnerability

Bugtraq ID:	55855
Class:	Design Error
CVE:	CVE-2012-0957
Remote:	No
Local:	Yes
Published:	Oct 09 2012 12:00AM
Updated:	Apr 13 2015 10:16PM
Credit:	Brad Spengler
Vulnerable:	Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 S.u.S.E. openSUSE 12.1 Redhat MRG Realtime for RHEL 6 Server 2 Linux kernel 3.5.3 Linux kernel 3.2.23 Linux kernel 3.2.13 Linux kernel 3.2.12 Linux kernel 3.2.9 Linux kernel 3.2.1 Linux kernel 3.2.2 Linux kernel 3.2
Not Vulnerable:

Linux Kernel 'uname()' System Call Local Information Disclosure Vulnerability

The Linux kernel is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Linux Kernel 'uname()' System Call Local Information Disclosure Vulnerability

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/55855.c

Linux Kernel 'uname()' System Call Local Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Linux Kernel 'uname()' System Call Local Information Disclosure Vulnerability

References:

• [oss-security] Linux kernel stack memory content leak via UNAME26 (Kees Cook)
  
• [PATCH] fix stack memory content leak via UNAME26 (lkml.org)
  
• Linux kernel Homepage (kernel.org)