PT-2013-3853 · Linux+2 · Linux Kernel+2

Dan Rosenberg

·

Publicado

2013-04-13

·

Atualizado

2025-04-03

·

CVE-2013-2596

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 3.8.9
Description The issue allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls. This is due to an integer overflow in the fb mmap function in drivers/video/fbmem.c. The Motochopper pwn program demonstrates this exploit.
Recommendations For Linux Kernel versions prior to 3.8.9, update to version 3.8.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the /dev/graphics/fb0 device file to minimize the risk of exploitation.

Exploit

Correção

Integer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CESA-2014_1392
CVE-2013-2596
RHSA-2014:1392
RHSA-2014_1392
RHSA-2015:0695
RHSA-2015:0782
RHSA-2015:0803
RHSA-2016:0450
RHSA-2016_0450

Produtos afetados

Centos
Linux Kernel
Red Hat