Description
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | systemtap | 1.2-3 | — |
| Debian 13 | systemtap | 1.2-3 | — |
| Debian 12 | systemtap | 1.2-3 | — |
| Debian 6.0 | systemtap | 1.2-5+squeeze1 | DSA-2348-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | systemtap +7 | 1.2-11.el6_0 | RHSA-2010:0894 |
| RHEL 5 | systemtap +6 | 1.1-3.el5_5.3 | RHSA-2010:0894 |
| RHEL 4 | systemtap +2 | 0.6.2-2.el4_8.3 | RHSA-2010:0895 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
SystemTap MODPROBE_OPTIONS Privilege Escalation
exploit/linux/local/systemtap_modprobe_options_priv_esc
Exploit-DB 2
- SystemTap 1.3 - MODPROBE_OPTIONS Privilege Escalation (Metasploit) EDB-46730 · local · Apr 19, 2019 · verified
- SystemTap - Local Privilege Escalation EDB-15620 · local · Nov 26, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2010:0894 Red Hat Security Advisory: systemtap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0895 Red Hat Security Advisory: systemtap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2348-1 systemtap - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- systemtap-staprun-priv-escalation(63344) vdb-entry
- [systemtap] 20101117 important systemtap security fix mailing-list
- FEDORA-2010-17873 vendor-advisory
- 15620 exploit
- 42263 third-party-advisory
- FEDORA-2010-17865 vendor-advisory
- http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git%3Ba=commit%3Bh=b7565b41228bea196cefa3a7d43ab67f8f9152e2
- RHSA-2010:0894 vendor-advisory
- RHSA-2010:0895 vendor-advisory
- 42306 third-party-advisory
- 44914 vdb-entry
- DSA-2348 vendor-advisory
- 1024754 vdb-entry
- 46920 third-party-advisory
- 42256 third-party-advisory
- 42318 third-party-advisory
- FEDORA-2010-17868 vendor-advisory
- http://packetstormsecurity.com/files/152569/SystemTap-1.3-MODPROBE_OPTIONS-Privilege-Escalation.html
- 46730 exploit