Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2012-2669

Overview

Vulnerability Score 2.1 2.1
CVE Id CVE-2012-2669
Last Modified 29 Jan 2013 11:51:02
Published 27 Dec 2012 06:47:00
Confidentiality Impact NONE NONE
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector LOCAL
Access Complexity LOW
Authentication NONE

CVE-2012-2669

Summary

The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.

Vulnerable Systems

Operating System

  • Linux Kernel 3.4.1

  • Linux Kernel 3.4.2

  • Linux Kernel 3.4.3

  • Linux Kernel 3.4.4

  • Linux Kernel 3.4.5


References

CONFIRM - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c

CONFIRM - https://github.com/torvalds/linux/commit/bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c

CONFIRM - https://bugzilla.novell.com/show_bug.cgi?id=761200

MLIST - [oss-security] 20121127 Re: CVE-2012-5532 hypervkvpd DoS

CONFIRM - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.5

MLIST - [oss-security] 20120606 Re: CVE-Request: hyper-v daemon

SUSE - openSUSE-SU-2012:1526

Related Patches

Novell SUSE 2012:6431 hyper-v security update for SLES 11 SP2 i586

Novell SUSE 2012:6431 hyper-v security update for SLES 11 SP2 x86_64

Novell SUSE 2012:7106 hyper-v recommended update for SLES 11 SP2 i586

Novell SUSE 2012:7106 hyper-v recommended update for SLES 11 SP2 x86_64


Last Updated: 27 May 2016 10:58:31