Description
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | systemtap | 1.6-1 | — |
| Debian 13 | systemtap | 1.6-1 | — |
| Debian 12 | systemtap | 1.6-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | systemtap +7 | 1.4-6.el6_1.2 | RHSA-2011:1088 |
Advisories 1
- RHSA-2011:1088 Red Hat Security Advisory: systemtap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=716476
- http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git%3Ba=commitdiff%3Bh=4ecaadf545a729bb3e5f01f6f019716d49815d9a
- 45377 third-party-advisory
- http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git%3Ba=blob%3Bf=NEWS%3Bhb=304d73b1fea24af791f2a129fb141c5009eae6a8