PT-2013-3397 · Linux+4 · Linux Kernel+4

Mateusz Guzik · Publicado 2013-03-22 · Atualizado 2023-02-13 · CVE-2013-1792

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Média

Vetor base

AV:L/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.8.3

Description A race condition issue exists in the install user keyrings function, allowing local users to cause a denial of service through crafted keyctl system calls. This can lead to a NULL pointer dereference and system crash when keyring operations are triggered in simultaneous threads.

Recommendations For Linux kernel versions prior to 3.8.3, update to version 3.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to keyctl system calls to minimize the risk of exploitation.

Exploit

Correção

DoS

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALT-PU-2013-1178

CESA-2013_0744

CVE-2013-1792

DSA-2668-1

OPENSUSE-SU-2013_1187-1

OPENSUSE-SU-2014_0204-1

RHSA-2013:0744

RHSA-2013:0829

RHSA-2013_0744

SUSE-SU-2015:0481-1

SUSE-SU-2015:0652-1

USN-1787-1

USN-1788-1

USN-1792-1

USN-1793-1

USN-1794-1

USN-1795-1

USN-1796-1

USN-1797-1

USN-1798-1

Produtos afetados

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Referências · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/recvmmsg_priv_esc.rb · Exploit
• 🔥 https://github.com/saelo/cve-2014-0038 · Exploit
• 🔥 https://github.com/tempbottle/CVE-2014-0196 · Exploit
• https://github.com/torvalds/linux/commit/0da9dfdd2cd9889201bc6f6f43580c99165cd087 · Nota
• https://lkml.org/lkml/2013/3/6/535 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2013:176 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-1792 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1798-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1793-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html · Aviso do Fabricante
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0da9dfdd2cd9889201bc6f6f43580c99165cd087 · Nota
• https://linux.oracle.com/errata/ELSA-2013-2520.html · Aviso do Fabricante
• http://ubuntu.com/usn/USN-1794-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-1787-1 · Aviso do Fabricante