PT-2013-1028 · Linux+2 · Linux Kernel+2
Publicado
2013-12-14
·
Atualizado
2024-02-01
·
CVE-2013-4587
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 3.12.5
Description
The issue allows local users to gain privileges via a large
id value, specifically through an array index error in the kvm vm ioctl create vcpu function in the KVM subsystem. This can be achieved by passing a vcpu id parameter with a high value.Recommendations
For Linux kernel versions through 3.12.5, update to a version newer than 3.12.5 to resolve the issue.
As a temporary workaround, consider restricting access to the
kvm vm ioctl create vcpu function to minimize the risk of exploitation.Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Linux Kernel
Suse