PT-2013-1100 · Debian+2 · Debian+2

Andy Lutomirski · Publicado 2013-02-18 · Atualizado 2023-02-13 · CVE-2013-1979

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Debian GNU/Linux versions prior to 3.8.11 Linux kernel versions prior to 3.8.11

Description The issue concerns multiple vulnerabilities in the Linux package of the Debian GNU/Linux operating system, which can be exploited by a local attacker to compromise the confidentiality, integrity, and availability of protected information. A specific problem is identified in the scm set cred function, where incorrect uid and gid values are used during credentials passing, allowing local users to gain privileges via a crafted application.

Recommendations For Debian GNU/Linux versions prior to 3.8.11, update to version 3.8.11 or later to resolve the issue. For Linux kernel versions prior to 3.8.11, update to version 3.8.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the scm set cred function until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-264

CWE-200

Identificadores relacionados

BDU:2015-03064

CVE-2013-1979

DSA-2669-1

RHSA-2013:0829

SUSE-RU-2015:0621-1

SUSE-SU-2014_1316-1

SUSE-SU-2014_1319-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

SUSE-SU-2019:14051-1

SUSE-SU-2019_14051-1

USN-1815-1

USN-1833-1

USN-1839-1

USN-1880-1

USN-1881-1

USN-1882-1

USN-1883-1

Produtos afetados

Debian

Linux Kernel

Suse

Referências · 103

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/rds_atomic_free_op_null_pointer_deref_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/futex_requeue.rb · Exploit
• 🔥 https://github.com/timwr/CVE-2014-3153 · Exploit
• 🔥 https://github.com/android-rooting-tools/libfutex_exploit · Exploit
• 🔥 https://github.com/lieanu/CVE-2014-3153 · Exploit
• 🔥 https://github.com/elongl/CVE-2014-3153 · Exploit
• 🔥 https://github.com/zerodavinci/CVE-2014-3153-exploit · Exploit
• https://github.com/torvalds/linux/commit/6a76f8c0ab19f215af2a3442870eeb5f0e81998d · Nota
• https://github.com/torvalds/linux/commit/83f1b4ba917db5dc5a061a44b3403ddb6e783494 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3235 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-1979 · Aviso do Fabricante
• https://bugzilla.suse.com/1128166 · Nota
• https://bugzilla.suse.com/1106886 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-1979 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1979 · Aviso do Fabricante