CVE-2012-0056

EXPLOITED

Linux Kernel < 3.0.18 - Privilege Escalation via /proc/<pid>/mem Write

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2012-0056 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including zx2c4, pythonone, srclib.

AI-analyzed exploit summary This exploit leverages a Linux kernel vulnerability (CVE-2012-0056) to achieve local privilege escalation by manipulating file descriptors and injecting shellcode into the 'su' binary's memory space.

Description

The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper.

Exploits (4)

exploitdb WORKING POC VERIFIED
by zx2c4 · clocallinux
https://www.exploit-db.com/exploits/18411

This exploit leverages a Linux kernel vulnerability (CVE-2012-0056) to achieve local privilege escalation by manipulating file descriptors and injecting shellcode into the 'su' binary's memory space.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel >=2.6.39
No auth needed
Prerequisites: Local access to the target system · GCC or similar compiler to build the exploit
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by zx2c4 · clocallinux
https://www.exploit-db.com/exploits/35161

This exploit leverages a memory corruption vulnerability in the Linux kernel (CVE-2012-0056) to achieve local privilege escalation by manipulating file descriptors and injecting shellcode into the 'su' binary's memory space.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (versions before the fix for CVE-2012-0056)
No auth needed
Prerequisites: Local access to the vulnerable system · Presence of the 'su' binary
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by pythonone · remote
https://github.com/pythonone/CVE-2012-0056

This repository contains a working exploit for CVE-2012-0056, a Linux local privilege escalation vulnerability in the /proc/pid/mem interface. The exploit leverages improper permission checks to write arbitrary memory to SUID processes, bypassing ASLR and self_exec_id protections.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel versions 2.6.39 to 3.2.1
No auth needed
Prerequisites: Access to a vulnerable Linux system · Ability to execute local binaries
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by srclib · remote
https://github.com/srclib/CVE-2012-0056

This repository contains a functional local privilege escalation exploit (mempodipper) for CVE-2012-0056, targeting a vulnerability in the Linux kernel's memory handling. The exploit leverages ptrace and /proc mem manipulation to achieve root access.

Classification
Working Poc 100%
Attack Type
Lpe
Complexity
Complex
Reliability
Reliable
Target: Linux kernel (specific versions affected by CVE-2012-0056)
No auth needed
Prerequisites: Local access to a vulnerable Linux system · Compilation tools (gcc, nasm)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (14)

Core 14
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51625
Third Party Advisory x_refsource_misc
http://blog.zx2c4.com/749
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://ubuntu.com/usn/usn-1336-1
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2012-0052.html
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47708
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/01/19/4
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/01/18/2
Third Party Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2012-0061.html
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/01/18/1
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/01/22/4
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=782642
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/470151

Scores

EPSS 0.6429
EPSS Percentile 98.5%

Details

VulnCheck KEV 2012-01-27
CWE
CWE-264
Status published
Products (1)
linux/linux_kernel 2.6.39 - 3.0.18
Published Jan 27, 2012
Tracked Since Feb 18, 2026