CVE-2012-3520
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages...
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
Exploit likelihood
What each source reports
NVD Score used
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
- Record
CVE-2012-3520- CVSS 2.0
- 1.9 Low
AV:L/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
- Record
CVE-2012-3520- Updated
- 2026-11-02
EUVDEUVD-2012-3475 No score
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
- Record
EUVD-2012-3475- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fxmm-x2w5-24cg No score
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages...
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
- Record
GHSA-fxmm-x2w5-24cg- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
- Record
CVE-2012-3520- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3520 No score
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
- Record
DEBIAN-CVE-2012-3520- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10128-1 No score
kernel-debug-4.8.13-1.1 on GA media
These are all security issues fixed in the kernel-debug-4.8.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10128-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2012-3520 No score
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
- Record
UBUNTU-CVE-2012-3520- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linuxDebian:12 |
before 3.2.29-1 | 3.2.29-1 |
linuxDebian:13 |
before 3.2.29-1 | 3.2.29-1 |
linuxDebian:14 |
before 3.2.29-1 | 3.2.29-1 |
kernel-rtRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-debugRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-debug-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-debug-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-debuginfo-common-x86_64Red Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
kernel-rt-docRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-firmwareRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-traceRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-trace-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-trace-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-vanillaRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-vanilla-debuginfoRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-rt-vanilla-develRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
mrg-rt-releaseRed Hat:enterprise_mrg:2:server:el6 |
before 0:3.2.33-rt50.66.el6rt | 0:3.2.33-rt50.66.el6rt |
kernel-sourceopenSUSE:Tumbleweed |
before 4.8.13-1.1 | 4.8.13-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3520 is a low vulnerability (CVSS 1.9) in Linux Kernel, published October 3, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in linux 3.2.29-1.
References
openwall.com/lists/oss-security/2012/08/22/1
securityfocus.com/bid/55152
lists.opensuse.org/opensuse-security-announce/2012-10/msg00005.html
github.com/torvalds/linux/commit/e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea
git.kernel.org?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea
oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Show 133 moreShow less
ubuntu.com/usn/USN-1599-1
kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.30
secunia.com/advisories/50848
bugzilla.redhat.com/show_bug.cgi?id=850449
nvd.nist.gov/vuln/detail/CVE-2012-3520
security-tracker.debian.org/tracker/CVE-2012-3520
access.redhat.com/errata/RHSA-2012:1491
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1491.json
cve.org/CVERecord?id=CVE-2012-0957
ubuntu.com/security/CVE-2012-3520
suse.com/security/cve/CVE-2009-3939