CVE-2011-1020 : The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc director

The proc filesystem implementation in the Linux kernel 2.6.37 and earlier does not restrict access to the /proc directory tree of a process after this process performs an exec of a setuid program, which allows local users to obtain sensitive information or cause a denial of service via open, lseek, read, and write system calls.

Published 2011-02-28 16:00:02

Updated 2020-08-12 16:35:27

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of serviceInformation leak

Threat overview for CVE-2011-1020

Top countries where our scanners detected CVE-2011-1020

Top open port discovered on systems with this issue 49152

IPs affected by CVE-2011-1020 2,923

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2011-1020!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2011-1020

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 8 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2011-1020

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2011-1020

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-1020

https://lkml.org/lkml/2011/2/9/417

LKML: (Eric W. Biederman): Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory
http://openwall.com/lists/oss-security/2011/02/24/18

oss-security - CVE request: kernel: /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory
https://lkml.org/lkml/2011/2/10/21

LKML: Kees Cook: Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory
https://lkml.org/lkml/2011/2/7/466

LKML: James Morris: Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory
http://www.securityfocus.com/bid/46567

Linux Kernel '/proc//' Permissions Handling Local Security Bypass Vulnerability
Third Party Advisory;VDB Entry
http://securityreason.com/securityalert/8107

Linux Kernel "/proc/<pid>/" Permissions Handling Weakness - CXSecurity.com
Third Party Advisory
https://lkml.org/lkml/2011/2/7/474

LKML: Kees Cook: Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory
https://lkml.org/lkml/2011/2/7/414

LKML: Kees Cook: Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory
http://seclists.org/fulldisclosure/2011/Jan/421

Full Disclosure: Proc filesystem and SUID-Binaries
Exploit;Mailing List;Third Party Advisory
https://lkml.org/lkml/2011/2/7/404

LKML: James Morris: Re: [SECURITY] /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory
http://www.halfdog.net/Security/2011/SuidBinariesAndProcInterface/

Interact with SUID binaries using /proc interface
Exploit;Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/65693

Linux Kernel proc/<pid>security bypass CVE-2011-1020 Vulnerability Report
Third Party Advisory;VDB Entry
https://lkml.org/lkml/2011/2/7/368

LKML: Kees Cook: [SECURITY] /proc/$pid/ leaks contents across setuid exec
Exploit;Mailing List;Third Party Advisory
http://openwall.com/lists/oss-security/2011/02/25/2

oss-security - Re: CVE request: kernel: /proc/$pid/ leaks contents across setuid exec
Mailing List;Third Party Advisory

Products affected by CVE-2011-1020