PT-2011-5209 · Linux+3 · Linux Kernel+3
Publicado
1970-01-01
·
Atualizado
2024-06-15
·
CVE-2013-0160
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 3.7.9
Description
The issue allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device. Multiple vulnerabilities in various packages of the openSUSE and Debian GNU/Linux operating systems can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally or remotely.
Recommendations
For Linux kernel versions through 3.7.9:
As a temporary workaround, consider restricting access to the /dev/ptmx device until a patch is available.
Avoid using the inotify API on the /dev/ptmx device until the issue is resolved.
For other affected packages in openSUSE and Debian GNU/Linux, restrict access to vulnerable components and apply configuration changes to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Buffer Overflow
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Debian
Linux Kernel
Suse
Opensuse