The POSIX Capability Linux Security Module (LSM) for Linux kernel 2.6 does not properly handle the credentials of a process that is launched before the module is loaded, which allows local users to gain privileges.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Realtime_linux_security_module | Gnu | 0.8.7 (including) | 0.8.7 (including) |
| Linux | Conectiva | 10.0 (including) | 10.0 (including) |
| Linux-source-2.6.15 | Ubuntu | dapper | * |
| Linux-source-2.6.17 | Ubuntu | edgy | * |
References
- http://distro.conectiva.com.br/atualizacoes/index.php?id=a\u0026anuncio=000930
- http://marc.info/?l=bugtraq\u0026m=110384535113035\u0026w=2
- http://www.securityfocus.com/bid/12093
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18673
- http://distro.conectiva.com.br/atualizacoes/index.php?id=a\u0026anuncio=000930
- http://marc.info/?l=bugtraq\u0026m=110384535113035\u0026w=2
- http://www.securityfocus.com/bid/12093
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18673