{"id":"CVE-2012-0056","published":"2012-01-27T15:00:00Z","modified":"2024-08-06T18:09:17Z","title":"The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the mem_write function of the Linux kernel (versions before 3.2.2), which fails to properly check permissions when writing to /proc/<pid>/mem. An attacker with local access and ASLR disabled can exploit this by modifying process memory to gain elevated privileges, as demonstrated by the Mempodipper technique.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:52Z"},"cvss":null,"epss":{"score":0.1084,"percentile":0.95837,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2012-01-27","exploitedFirstSeen":"2012-01-27","ransomware":false,"evidence":[{"url":"https://www.kb.cert.org/vuls/id/470151","date":"2012-01-27"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"clone urlhaus 23may CREATED 11 MONTHS AGO MODIFIED 2 MONTHS AGO by skocherhan Public TLP:  Green REFERENCE: https://urlhaus.abuse.ch/downloads/json_online/","url":"https://otx.alienvault.com/pulse/69d47764f2270074641b9efa","created":"2026-04-07"},{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"urlhaus 23may","url":"https://otx.alienvault.com/pulse/682fec831be07e4fdf69fe47","created":"2025-05-23"},{"name":"IOC Records Provided by @NextRayAI","url":"https://otx.alienvault.com/pulse/63456c2a30b92337ea1670e0","created":"2022-10-11"},{"name":"The Elastic Botnet","url":"https://otx.alienvault.com/pulse/557b7ca6b45ff5450f63f4f5","created":"2015-06-13"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/51625","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://blog.zx2c4.com/749","tags":["x_refsource_MISC"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=e268337dfe26dfc7efd422a804dbb27977a3cccc","tags":["x_refsource_CONFIRM"]},{"url":"http://ubuntu.com/usn/usn-1336-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.redhat.com/support/errata/RHSA-2012-0052.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/47708","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.openwall.com/lists/oss-security/2012/01/19/4","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2012/01/18/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.redhat.com/support/errata/RHSA-2012-0061.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.openwall.com/lists/oss-security/2012/01/18/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2012/01/22/4","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=782642","tags":["x_refsource_CONFIRM"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.2","tags":["x_refsource_CONFIRM"]},{"url":"http://www.kb.cert.org/vuls/id/470151","tags":["third-party-advisory","x_refsource_CERT-VN"]}],"techniques":[],"reports":[{"id":"SRC-93c55e10ab45afc37c85","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf","date":null,"mentions":[{"quote":"3Q15 4Q15 1Q16 2Q16\r\nEncounter rate (percent of all reporting computers)\r\nWin32/CplLnk\r\n(see below)\r\n0.000%\r\n0.001%\r\n0.002%\r\n0.003%\r\n0.004%\r\n0.005%\r\n0.006%\r\n0.007%\r\n0.008%\r\n3Q15 4Q15 1Q16 2Q16\r\nEncounter rate (percent of all reporting computers)\r\nUnix/Lotoor\r\nCVE-2014-6332\r\nCVE-2011-1823\r\n(GingerBreak)\r\nCVE-2012-0056","start":108127,"end":108445},{"quote":"CVE-2012-0056, 60","start":261296,"end":261313}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2012-0094","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0094","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":18411,"url":"https://www.exploit-db.com/exploits/18411","title":"Linux Kernel 2.6.39 < 3.2.2 (Gentoo / Ubuntu x86/x64) - 'Mempodipper' Local Privilege Escalation (1)","type":"local","platform":"linux","date":"2012-01-23","verified":true,"provenance":"source"},{"id":35161,"url":"https://www.exploit-db.com/exploits/35161","title":"Linux Kernel 2.6.39 < 3.2.2 (x86/x64) - 'Mempodipper' Local Privilege Escalation (2)","type":"local","platform":"linux","date":"2012-01-12","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2012-01-12"},"pocGithub":{"count":2,"skipped":0,"earliest":"2012-12-29","earliestUrl":"https://github.com/srclib/CVE-2012-0056","repos":[{"name":"srclib/CVE-2012-0056","url":"https://github.com/srclib/CVE-2012-0056","stars":1,"created":"2012-12-29"},{"name":"pythonone/CVE-2012-0056","url":"https://github.com/pythonone/CVE-2012-0056","stars":1,"created":"2016-07-22"}]},"first":{"date":"2012-01-12","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/35161"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2012-01-12","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-35161); later: PoC-in-GitHub 2012-12-29","url":"https://www.exploit-db.com/exploits/35161","provenance":"source"},{"date":"2012-01-27","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2012-0056","provenance":"source"},{"date":"2012-01-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.kb.cert.org/vuls/id/470151","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":64.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 5389 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.17,"detail":"percentile 0.9584"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"2 Exploit-DB entries; 2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}