製品・ソフトウェアに関する情報

JVN脆弱性詳細

Linux Kernel の regset 関数におけるサービス運用妨害 (NULL ポインタデリファレンス) の脆弱性

Title	Linux Kernel の regset 関数におけるサービス運用妨害 (NULL ポインタデリファレンス) の脆弱性
Summary	Linux Kernel の regset 関数は、.get および .set メソッドが存在しない場合、適切に処理を行わないため、サービス運用妨害 (NULL ポインタデリファレンス) 状態となる、または詳細不明な影響を受ける脆弱性が存在します。
Possible impacts	ローカルユーザにより、(1) PTRACE_GETREGSET または (2) PTRACE_SETREGSET の ptrace コールを介して、サービス運用妨害 (NULL ポインタデリファレンス) 状態にされる、または詳細不明な影響を受ける可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 17, 2012, midnight
Registration Date	May 18, 2012, 3:50 p.m.
Last Update	May 18, 2012, 3:50 p.m.

CVSS2.0 : 危険
Score	7.2
Vector	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected System

Linux

Linux Kernel 3.2.10 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-1097	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1097
National Vulnerability Database (NVD)
2	CVE-2012-1097	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-1097

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-DesignError	https://www.ipa.go.jp/security/vuln/CWE.html#CWEDesignError

ベンダー情報

No	Name	URL
Linux Kernel
1	ChangeLog-3.2.10	http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10
2	Linux Kernel Archives	http://www.kernel.org
Red Hat Security Advisory
3	RHSA-2012:0481	https://rhn.redhat.com/errata/RHSA-2012-0481.html

Change Log

No	Changed Details	Date of change
0	[2012年05月18日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2012-1097

Summary	The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call.
Publication Date	May 17, 2012, 8 p.m.
Registration Date	Jan. 28, 2021, 2:54 p.m.
Last Update	Nov. 21, 2024, 10:36 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:o:linux:linux_kernel::::::::				3.0.24
cpe:2.3:o:linux:linux_kernel::::::::	3.1			3.2.10

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:4.0:::::::*
cpe:2.3:o:redhat:enterprise_mrg:2.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_server:11:sp1::::vmware::*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::vmware::*
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:::-:::*
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:::-:::*

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c8e252586f8d5de906385d8cf6385fee289a825e
2	http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c8e252586f8d5de906385d8cf6385fee289a825e
3	http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html	Mailing List Third Party Advisory
7	http://rhn.redhat.com/errata/RHSA-2012-0481.html	Third Party Advisory
8	http://rhn.redhat.com/errata/RHSA-2012-0481.html	Third Party Advisory
9	http://rhn.redhat.com/errata/RHSA-2012-0531.html	Third Party Advisory
10	http://rhn.redhat.com/errata/RHSA-2012-0531.html	Third Party Advisory
11	http://secunia.com/advisories/48842	Broken Link
12	http://secunia.com/advisories/48842	Broken Link
13	http://secunia.com/advisories/48898	Broken Link
14	http://secunia.com/advisories/48898	Broken Link
15	http://secunia.com/advisories/48964	Broken Link
16	http://secunia.com/advisories/48964	Broken Link
17	http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10	Mailing List Patch Vendor Advisory
18	http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10	Mailing List Patch Vendor Advisory
19	http://www.openwall.com/lists/oss-security/2012/03/05/1	Mailing List Patch Third Party Advisory
20	http://www.openwall.com/lists/oss-security/2012/03/05/1	Mailing List Patch Third Party Advisory
21	https://bugzilla.redhat.com/show_bug.cgi?id=799209	Issue Tracking Patch Third Party Advisory
22	https://bugzilla.redhat.com/show_bug.cgi?id=799209	Issue Tracking Patch Third Party Advisory
23	https://github.com/torvalds/linux/commit/c8e252586f8d5de906385d8cf6385fee289a825e	Patch Third Party Advisory
24	https://github.com/torvalds/linux/commit/c8e252586f8d5de906385d8cf6385fee289a825e	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-476	NULL ポインタデリファレンス	https://cwe.mitre.org/data/definitions/476.html

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_server:11:sp1::::vmware::*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::vmware::*
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp1::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:::-:::*
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:::-:::*