NetSight
IP …
medium4.4

CVE-2011-2502

runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specif…

Impact

runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.

Affected products

VendorProductAffected versions
SystemtapSystemtap
through 1.5
Versions 0.2.2, 0.3, 0.4, 0.5, 0.5.3

Weakness classification

CWE-20

References