CVE-2011-2502
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6...
CVE-2011-2502 is a medium vulnerability (CVSS 4.4) in Systemtap, published July 26, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in systemtap 1.6-1.
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
Exploit likelihood
What each source reports
NVD Score used
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
- Record
CVE-2011-2502- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
- Record
CVE-2011-2502- Updated
- 2026-11-02
EUVDEUVD-2011-2489 No score
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
- Record
EUVD-2011-2489- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gmjv-9hc6-6rf5 No score
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6...
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
- Record
GHSA-gmjv-9hc6-6rf5- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
- Record
CVE-2011-2502- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-2502 No score
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
- Record
DEBIAN-CVE-2011-2502- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
systemtapDebian:12 |
before 1.6-1 | 1.6-1 |
systemtapDebian:13 |
before 1.6-1 | 1.6-1 |
systemtapDebian:14 |
before 1.6-1 | 1.6-1 |
systemtapRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-clientRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-grapherRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-initscriptRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-runtimeRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-sdt-develRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-serverRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
systemtap-testsuiteRed Hat:enterprise_linux:6::server |
before 0:1.4-6.el6_1.2 | 0:1.4-6.el6_1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
bugzilla.redhat.com/show_bug.cgi?id=716476
sources.redhat.com/git/gitweb.cgi?p=systemtap.git%3Ba=commitdiff%3Bh=4ecaadf545a729bb3e5f01f6f019716d49815d9a
secunia.com/advisories/45377
nvd.nist.gov/vuln/detail/CVE-2011-2502
Show 13 moreShow less
github.com/advisories/GHSA-gmjv-9hc6-6rf5
security-tracker.debian.org/tracker/CVE-2011-2502
access.redhat.com/errata/RHSA-2011:1088
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1088.json
cve.org/CVERecord?id=CVE-2011-2502