The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBEOPTIONS environment variable to specify a malicious configuration file.

It was found that systemtap runtime tool (staprun) did not properly enforce the module's path sanity check, when the ad-hoc module instrumentation via user-space probing with user-specified module path was requested. A local user, member of the 'stapusr' group could use this flaw to escalate their privileges.

A security flaw was found in the way systemtap runtime tool (staprun) removed unused modules. A local attacker could use this flaw to conduct various denial of service attacks.

References: [1] http://sources.redhat.com/ml/systemtap/2010-q4/msg00230.html

Upstream changeset: [2] http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git;a=commit;h=b7565b41228bea196cefa3a7d43ab67f8f9152e2

Acknowledgements:

Red Hat would like to thank Tavis Ormandy for reporting this issue.