CyberSec.Space Logo
Back to CVE Browser

CVE-2010-4170

HIGH
7.2
CVSS Severity Score
EPSS Score0.1210%
EPSS Percentile5.04th
PublishedDec 7, 2010
Last ModifiedApr 29, 2026

Vulnerability Description

The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.

Affected Platforms (CPE)

📦
Systemtap

Systemtap

= 1.3

References & Advisories

🔗 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html
🔗 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051122.html
🔗 http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051127.html
🔗 http://packetstormsecurity.com/files/152569/SystemTap-1.3-MODPROBE_OPTIONS-Privilege-Escalation.html
🔗 http://secunia.com/advisories/42256
🔗 http://secunia.com/advisories/42263
🔗 http://secunia.com/advisories/42306
🔗 http://secunia.com/advisories/42318

Related Vulnerabilities

CVE-2009-427310.0

stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command...

CVE-2010-04127.5

stap-server in SystemTap 1.1 does not properly restrict the value of the -B (aka BUILD) option, which allows attackers to have an ...

CVE-2009-07846.3

Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrar...

CVE-2012-08755.4

SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive infor...