PT-2011-5230 · Red Hat+5 · Systemtap-Runtime-Debuginfo+20
Andrew Honig
·
Publicado
1970-01-01
·
Atualizado
2023-02-13
·
CVE-2013-1798
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
openSUSE versions prior to the fixed version
Linux kernel versions through 3.8.4
systemtap versions (affected versions not specified)
systemtap-runtime versions (affected versions not specified)
systemtap-runtime-debuginfo versions (affected versions not specified)
systemtap-server versions (affected versions not specified)
systemtap-server-debuginfo versions (affected versions not specified)
systemtap-client versions (affected versions not specified)
systemtap-client-debuginfo versions (affected versions not specified)
systemtap-sdt-devel versions (affected versions not specified)
libvmtools0 versions (affected versions not specified)
libvmtools0-debuginfo versions (affected versions not specified)
kernel-vanilla-base versions (affected versions not specified)
kernel-vanilla-base-debuginfo versions (affected versions not specified)
systemtap-debuginfo versions (affected versions not specified)
systemtap-debugsource versions (affected versions not specified)
libvmtools-devel versions (affected versions not specified)
Description
The issue involves multiple vulnerabilities in various packages of the openSUSE operating system and the Linux kernel, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely or locally, depending on the specific package and version. The
ioapic read indirect function in the Linux kernel does not properly handle certain combinations of invalid IOAPIC REG SELECT and IOAPIC REG WINDOW operations, allowing guest OS users to obtain sensitive information from host OS memory or cause a denial of service.Recommendations
For Linux kernel versions through 3.8.4, update to a version later than 3.8.4 to resolve the issue.
For systemtap and its related packages, there is no information about a newer version that contains a fix for this vulnerability.
For kernel-vanilla-base and its related packages, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, consider restricting access to vulnerable packages and modules to minimize the risk of exploitation.
Avoid using vulnerable functions and parameters in affected API endpoints until the issue is resolved.
Exploit
DoS
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Kernel-Vanilla-Base
Kernel-Vanilla-Base-Debuginfo
Libvmtools-Devel
Libvmtools0
Libvmtools0-Debuginfo
Opensuse
Systemtap
Systemtap-Client
Systemtap-Client-Debuginfo
Systemtap-Debuginfo
Systemtap-Debugsource
Systemtap-Runtime
Systemtap-Runtime-Debuginfo
Systemtap-Sdt-Devel
Systemtap-Server
Systemtap-Server-Debuginfo