CVE-2011-1020

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.6.37 and earlier

Description The issue allows local users to obtain sensitive information or cause a denial of service. This is due to the proc filesystem implementation not restricting access to the /proc directory tree of a process after it performs an exec of a setuid program, enabling the use of open, lseek, read, and write system calls.

Recommendations For Linux kernel versions 2.6.37 and earlier, consider restricting access to the /proc directory tree of a process after it performs an exec of a setuid program as a temporary workaround until a patch is available.