Veille CVE
CVE-2013-6282
8.8 Élevée Exploitée activementCatalogue CISA KEV — Linux Kernel Improper Input Validation Vulnerability
Ajoutée le 15/09/2022 · Échéance de correction (agences US) : 06/10/2022
Action requise : Apply updates per vendor instructions.
Description
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.2 Élevée | nvd@nist.gov (NVD) | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Faiblesses (CWE)
Références
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04 Patch
- http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282 Patch
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5 Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2013/11/14/11 Mailing List
- http://www.securityfocus.com/bid/63734 Third Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-2067-1 Third Party AdvisoryVDB Entry
- https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04 ExploitPatch
- https://www.exploit-db.com/exploits/40975/ ExploitThird Party AdvisoryVDB Entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04 Patch
- http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282 Patch
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5 Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2013/11/14/11 Mailing List
- http://www.securityfocus.com/bid/63734 Third Party AdvisoryVDB Entry
- http://www.ubuntu.com/usn/USN-2067-1 Third Party AdvisoryVDB Entry
- https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04 ExploitPatch
- https://www.exploit-db.com/exploits/40975/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-6282 US Government Resource