Description
The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | systemtap | 1.6-1 | — |
| Debian 13 | systemtap | 1.6-1 | — |
| Debian 12 | systemtap | 1.6-1 | — |
| Debian 6.0 | systemtap | 1.2-5+squeeze1 | DSA-2348-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | systemtap +7 | 1.4-6.el6_1.2 | RHSA-2011:1088 |
| RHEL 5 | systemtap +6 | 1.3-9.el5 | RHSA-2011:1089 |
Advisories 3
- RHSA-2011:1088 Red Hat Security Advisory: systemtap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:1089 Red Hat Security Advisory: systemtap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2348-1 systemtap - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2503
- http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git%3Ba=commitdiff%3Bh=ed51cfa24ca27746ab09b59280b94117dd58cba3
- DSA-2348 vendor-advisory
- 46920 third-party-advisory
- 45377 third-party-advisory
- http://sources.redhat.com/git/gitweb.cgi?p=systemtap.git%3Ba=blob%3Bf=NEWS%3Bhb=304d73b1fea24af791f2a129fb141c5009eae6a8