CVE-2010-4170
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before...
7.2 HighPublic exploitFix available
CVE-2010-4170 is a high vulnerability (CVSS 7.2) in Systemtap, published December 7, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.83%, the 93rd percentile. Fixed in systemtap 1.2-3.
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
Exploit likelihood
5.83%Up 3.7 points since Feb 4, 2022
What each source reports
NVD Score used
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
- Record
CVE-2010-4170- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
- Record
CVE-2010-4170- Updated
- 2026-11-02
EUVDEUVD-2010-4146 No score
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
- Record
EUVD-2010-4146- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j34m-wwxr-2pj4 No score
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before...
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
- Record
GHSA-j34m-wwxr-2pj4- Updated
- 2026-11-02
OSV No score
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
- Record
CVE-2010-4170- Updated
- 2026-11-02
OSVDEBIAN-CVE-2010-4170 No score
The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
- Record
DEBIAN-CVE-2010-4170- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
systemtapDebian:12 |
before 1.2-3 | 1.2-3 |
systemtapDebian:13 |
before 1.2-3 | 1.2-3 |
systemtapDebian:14 |
before 1.2-3 | 1.2-3 |
systemtapDebian:6.0 |
before 1.2-5+squeeze1, plus listed versions 1.2-5 |
1.2-5+squeeze1 |
systemtapRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-clientRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-debuginfoRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-initscriptRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-runtimeRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-sdt-develRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
Show 62 moreShow less
| Package | Affected | Fixed |
|---|---|---|
systemtap-serverRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-testsuiteRed Hat:enterprise_linux:5::client |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtapRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-clientRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-debuginfoRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-initscriptRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-runtimeRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-sdt-develRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-serverRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtap-testsuiteRed Hat:enterprise_linux:5::server |
before 0:1.1-3.el5_5.3 | 0:1.1-3.el5_5.3 |
systemtapRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-debuginfoRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-sdt-develRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-serverRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-testsuiteRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-clientRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-grapherRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-initscriptRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-runtimeRed Hat:enterprise_linux:6::client |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtapRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-grapherRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-sdt-develRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-serverRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-testsuiteRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-clientRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-initscriptRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-runtimeRed Hat:enterprise_linux:6::computenode |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtapRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-testsuiteRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-clientRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-grapherRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-initscriptRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-runtimeRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-sdt-develRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-serverRed Hat:enterprise_linux:6::server |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtapRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-testsuiteRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-clientRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-grapherRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-initscriptRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-runtimeRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-sdt-develRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtap-serverRed Hat:enterprise_linux:6::workstation |
before 0:1.2-11.el6_0 | 0:1.2-11.el6_0 |
systemtapRed Hat:enterprise_linux:4::as |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-debuginfoRed Hat:enterprise_linux:4::as |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-runtimeRed Hat:enterprise_linux:4::as |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-testsuiteRed Hat:enterprise_linux:4::as |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtapRed Hat:enterprise_linux:4::desktop |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-runtimeRed Hat:enterprise_linux:4::desktop |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-testsuiteRed Hat:enterprise_linux:4::desktop |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtapRed Hat:enterprise_linux:4::es |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-debuginfoRed Hat:enterprise_linux:4::es |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-runtimeRed Hat:enterprise_linux:4::es |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-testsuiteRed Hat:enterprise_linux:4::es |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtapRed Hat:enterprise_linux:4::ws |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-runtimeRed Hat:enterprise_linux:4::ws |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
systemtap-testsuiteRed Hat:enterprise_linux:4::ws |
before 0:0.6.2-2.el4_8.3 | 0:0.6.2-2.el4_8.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | SystemTap - Local Privilege Escalation | 2010-11-26 |
| Exploit-DB | SystemTap 1.3 - MODPROBE_OPTIONS Privilege Escalation (Metasploit) | 2019-04-19 |
| Metasploit | SystemTap MODPROBE_OPTIONS Privilege Escalation | 2010-11-17 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
References
exchange.xforce.ibmcloud.com/vulnerabilities/63344
sources.redhat.com/ml/systemtap/2010-q4/msg00230.html
lists.fedoraproject.org/pipermail/package-announce/2010-November/051127.html
exploit-db.com/exploits/15620
secunia.com/advisories/42263
Show 29 moreShow less
redhat.com/support/errata/RHSA-2010-0894.html
securityfocus.com/bid/44914
debian.org/security/2011/dsa-2348
securitytracker.com/id?1024754
packetstormsecurity.com/files/152569/SystemTap-1.3-MODPROBE_OPTIONS-Privilege-Escalation.html
nvd.nist.gov/vuln/detail/CVE-2010-4170
access.redhat.com/errata/RHSA-2010:0894
bugzilla.redhat.com/show_bug.cgi?id=653604
github.com/advisories/GHSA-j34m-wwxr-2pj4
security-tracker.debian.org/tracker/CVE-2010-4170
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0894.json
cve.org/CVERecord?id=CVE-2010-4170