PT-2013-1101 · Linux+2 · Linux Kernel+2

Theodore Tso · Publicado 2013-02-18 · Atualizado 2023-02-13 · CVE-2013-2015

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.7.3

Description The issue allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media. This is due to the ext4 orphan del function in fs/ext4/namei.c not properly handling orphan-list entries for non-journal filesystems. Multiple vulnerabilities in the Linux package of the Debian GNU/Linux operating system can be exploited by a local attacker, potentially leading to breaches of confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions prior to 3.7.3, update to version 3.7.3 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for other affected versions.

Correção

DoS

Information Disclosure

Enumeração de Fraquezas

CWE-399

CWE-200

Identificadores relacionados

BDU:2015-03064

CVE-2013-2015

DSA-2668-1

DSA-2669-1

MGASA-2013-0342

MGASA-2013-0343

MGASA-2013-0344

MGASA-2013-0345

MGASA-2013-0346

SUSE-SU-2015:0652-1

SUSE-SU-2016:2074-1

Produtos afetados

Debian

Linux Kernel

Suse

Referências · 177

• https://github.com/torvalds/linux/commit/6a76f8c0ab19f215af2a3442870eeb5f0e81998d · Nota
• https://github.com/torvalds/linux/commit/0e9a9a1ad619e7e987815d20262d36a2f95717ca · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3235 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-2384 · Nota
• https://suse.com/security/cve/CVE-2016-4486 · Nota
• https://bugzilla.suse.com/953527 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3225 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2015 · Nota de Segurança
• https://bugzilla.suse.com/935757 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3076 · Nota de Segurança
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0e9a9a1ad619e7e987815d20262d36a2f95717ca · Nota
• https://bugzilla.suse.com/968010 · Nota
• https://suse.com/security/cve/CVE-2015-7509 · Nota
• https://bugzilla.suse.com/968011 · Nota
• https://bugzilla.suse.com/968012 · Nota