CVE-2011-2503: The insert_module function in… (CVSS 3.7)

Description

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Exploit likelihood

0.44%Down 0.6 points since Feb 4, 2022

Affected products

systemtap

Affected packages

Affected packages
Package	Affected	Fixed
`systemtap` Debian:12	before 1.6-1	1.6-1
`systemtap` Debian:13	before 1.6-1	1.6-1
`systemtap` Debian:14	before 1.6-1	1.6-1
`systemtap` Debian:6.0 From an advisory covering 3 CVEs	before 1.2-5+squeeze1, plus listed versions 1.2-5	1.2-5+squeeze1
`systemtap` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap-client` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap-debuginfo` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap-grapher` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap-initscript` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap-runtime` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2

Show 19 moreShow less

Affected packages
Package	Affected	Fixed
`systemtap-sdt-devel` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap-server` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap-testsuite` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 0:1.4-6.el6_1.2	0:1.4-6.el6_1.2
`systemtap` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-client` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-debuginfo` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-initscript` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-runtime` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-sdt-devel` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-server` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-testsuite` Red Hat:enterprise_linux:5::client	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-client` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-debuginfo` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-initscript` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-runtime` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-sdt-devel` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-server` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5
`systemtap-testsuite` Red Hat:enterprise_linux:5::server	before 0:1.3-9.el5	0:1.3-9.el5

What each source reports

NVD Score used3.7

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Record: CVE-2011-2503
CVSS 2.0: 3.7 LowAV:L/AC:H/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE ListNo score

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Record: CVE-2011-2503
Updated: 2026-11-02

EUVDEUVD-2011-2490No score

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Record: EUVD-2011-2490
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q2gw-mhhj-386xNo score

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool ...

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Record: GHSA-q2gw-mhhj-386x
Weakness: CWE-20
Updated: 2026-11-02

OSVNo score

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Record: CVE-2011-2503
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-2503No score

The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.

Record: DEBIAN-CVE-2011-2503
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 17 moreShow less