SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer.

This systemtap updated fixes a security issue and bugs :

Security fix: Fix kernel panic when processing malformed DWARF unwind data (bnc#748564 CVE-2012-0875)

Also bugs were fixed :

  - Change how systemtap looks for tracepoint header files     (bnc#796574, new patch:
    systemtap-build-source-dir.patch)

  - Add libebl1 dependency. Systemtap manually loads libebl     backends and the manual Requires: was incorrectly     removed in a previous revision (bnc#800335)

The remote host is affected by the vulnerability described in GLSA-201406-04 (SystemTap: Denial of Service)

    SystemTap does not properly handle DWARF expressions when unwinding the       stack.
  Impact :

    A local attacker with SystemTap permissions could trigger a kernel       panic, causing a Denial of Service condition.
  Workaround :

    Disabling unprivileged mode is a temporary workaround for this       vulnerability.

An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user (root, or a member of the stapdev group) could trigger this flaw when tricked into instrumenting a specially crafted ELF binary, even when unprivileged mode was not enabled. (CVE-2012-0875)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0376 advisory.

    [1.6-5.0.1.el6_2]
    - remove doc/SystemTap_Beginners_Guide/en-US in tarball
    - comment bz683569.patch in specfile
    - remove buildtime dependency on package publican-redhat

    [1.6-5]
    - CVE-2012-0875

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This collective update for systemtap provides the following fixes :

  - Change how systemtap looks for tracepoint header files.
    (bnc#796574)

  - Systemtap manually loads libebl backends. Add libebl1     dependency. (bnc#800335)

  - Fix kernel panic when processing malformed DWARF unwind     data. (bnc#748564, CVE-2012-0875)

SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system.

An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user (root, or a member of the stapdev group) could trigger this flaw when tricked into instrumenting a specially crafted ELF binary, even when unprivileged mode was not enabled. (CVE-2012-0875)

SystemTap users should upgrade to these updated packages, which contain a backported patch to correct this issue.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0376 advisory.

    SystemTap is an instrumentation system for systems running the Linux     kernel. The system allows developers to write scripts to collect data on     the operation of the system.

    An invalid pointer read flaw was found in the way SystemTap handled     malformed debugging information in DWARF format. When SystemTap     unprivileged mode was enabled, an unprivileged user in the stapusr group     could use this flaw to crash the system or, potentially, read arbitrary     kernel memory. Additionally, a privileged user (root, or a member of the     stapdev group) could trigger this flaw when tricked into instrumenting a     specially-crafted ELF binary, even when unprivileged mode was not enabled.
    (CVE-2012-0875)

    SystemTap users should upgrade to these updated packages, which contain a     backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated systemtap packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system.

An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user (root, or a member of the stapdev group) could trigger this flaw when tricked into instrumenting a specially crafted ELF binary, even when unprivileged mode was not enabled. (CVE-2012-0875)

SystemTap users should upgrade to these updated packages, which contain a backported patch to correct this issue.

This respin fixes the CVE-2012-0875 vulnerability.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74926	openSUSE Security Update : systemtap (openSUSE-SU-2013:0475-1)	Nessus	SuSE Local Security Checks	medium
74319	GLSA-201406-04 : SystemTap: Denial of Service	Nessus	Gentoo Local Security Checks	medium
69661	Amazon Linux AMI : systemtap (ALAS-2012-54)	Nessus	Amazon Linux Local Security Checks	medium
68494	Oracle Linux 5 / 6 : systemtap (ELSA-2012-0376)	Nessus	Oracle Linux Local Security Checks	high
65940	SuSE 11.2 Security Update : systemtap (SAT Patch Number 7444)	Nessus	SuSE Local Security Checks	medium
61281	Scientific Linux Security Update : systemtap on SL5.x, SL6.x i386/x86_64 (20120308)	Nessus	Scientific Linux Local Security Checks	medium
58298	RHEL 5 / 6 : systemtap (RHSA-2012:0376)	Nessus	Red Hat Local Security Checks	high
58294	CentOS 5 / 6 : systemtap (CESA-2012:0376)	Nessus	CentOS Local Security Checks	medium
58160	Fedora 17 : systemtap-1.7-2.fc17 (2012-2269)	Nessus	Fedora Local Security Checks	medium
58126	Fedora 15 : systemtap-1.7-2.fc15 (2012-2218)	Nessus	Fedora Local Security Checks	medium
58125	Fedora 16 : systemtap-1.7-2.fc16 (2012-2213)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-0875

high

Tenable Plugins

medium

medium

medium

high

medium

medium

high

medium

medium

medium

medium