CVE-2012-2669

Published: Dec 27, 2012Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.

Affected (4)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	Up to 3.4.4
Linux Linux Kernel	Version 3.4.1
Linux Linux Kernel	Version 3.4.2
Linux Linux Kernel	Version 3.4.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (14)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2012-11/msg00042.html

Source: secalert@redhat.com

http://openwall.com/lists/oss-security/2012/06/06/12

Source: secalert@redhat.com

http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.5

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/11/27/12

Source: secalert@redhat.com

https://bugzilla.novell.com/show_bug.cgi?id=761200

Source: secalert@redhat.com

https://github.com/torvalds/linux/commit/bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c

Source: secalert@redhat.com

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bcc2c9c3fff859e0eb019fe6fec26f9b8eba795c