Bug 440782

Summary:	Kernel : "uname()" Kernel Memory Disclosure Weakness (CVE-2012-0957)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Kernel	Assignee:	Gentoo Kernel Security <security-kernel>
Status:	RESOLVED OBSOLETE
Severity:	normal	CC:	kernel
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2012-11-01 16:41:49 UTC

From https://secunia.com/advisories/50895/ :

Description
A weakness has been reported in Linux Kernel, which can be exploited by malicious, local users to 
disclose potentially sensitive system information.

The weakness is caused due to an error when populating the system information structure as a result 
of the "uname()" system call. This can be exploited to disclose some kernel stack-based memory via 
the UNAME26 execution domain.


Solution
Update to a fixed version if available.
Further details available in Customer Area

Provided and/or discovered by
Reported by Brad Spengler via a patch.

Changelog
Further details available in Customer Area

Original Advisory
https://lkml.org/lkml/2012/10/9/550
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.4.16
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.0.49
http://www.kernel.org/pub/linux/kernel/v3.0/ChangeLog-3.2.33

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2018-04-04 18:14:30 UTC

There are no longer any 2.x or <3.4.16 kernels available in the repository with the exception of sys-kernel/xbox-sources which is unsupported by security.