What’s Vulnerable › Vulnerabilities

CVE-2012-1097

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-05-17 · updated 2026-06-16
• Weakness: CWE-476

Description

The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call.

Affected products

• Linux kernel: before 3.0.24; from 3.1 before 3.2.10 — fixed in 3.0.24, 3.2.10
• Red Hat Enterprise Linux: 4.0
• RedHat Enterprise Mrg: 2.0
• SUSE Linux Enterprise Server 15 SP1: 11-sp1, 11-sp2
• SUSE Linux Enterprise High Availability Extension: 11-sp1, 11-sp2
• SUSE Linux Enterprise Server: 11-sp1, 11-sp2

How to fix

Upgrade to a fixed version: Linux kernel 3.0.24, 3.2.10. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c8e252586f8d5de906385d8cf6385fee289a825e
• http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html
• http://rhn.redhat.com/errata/RHSA-2012-0481.html
• http://rhn.redhat.com/errata/RHSA-2012-0531.html
• http://secunia.com/advisories/48842
• http://secunia.com/advisories/48898
• http://secunia.com/advisories/48964
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10
• http://www.openwall.com/lists/oss-security/2012/03/05/1
• https://bugzilla.redhat.com/show_bug.cgi?id=799209
• https://github.com/torvalds/linux/commit/c8e252586f8d5de906385d8cf6385fee289a825e

Get alerted when CVE-2012-1097 or the next vulnerability affects your stack