Eric W. Biederman

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 2.6.37 and earlier **Description** The issue allows local users to obtain sensitive information or cause a denial of service. This is due to the proc filesystem implementation not restricting access to the /proc directory tree of a process after it performs an exec of a setuid program, enabling the use of open, lseek, read, and write system calls. **Recommendations** For Linux kernel versions 2.6.37 and earlier, consider restricting access to the /proc directory tree of a process after it performs an exec of a setuid program as a temporary workaround until a patch is available.