The flaw is in the mem_write function of the Linux kernel (versions before 3.2.2), which fails to properly check permissions when writing to /proc/<pid>/mem. An attacker with local access and ASLR disabled can exploit this by modifying process memory to gain elevated privileges, as demonstrated by the Mempodipper technique.
The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.
First seen exploited the day it was disclosed. Public exploit code (Exploit-DB) was available 15 days before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Reports are matched by finding the exact id CVE-2012-0056 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/CplLnk (see below) 0.000% 0.001% 0.002% 0.003% 0.004% 0.005% 0.006% 0.007% 0.008% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Unix/Lotoor CVE-2014-6332 CVE-2011-1823 (GingerBreak) CVE-2012-0056…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.