PT-2013-4919 · Linux+1 · Linux Kernel+1
Vince Weaver
·
Publicado
2013-08-24
·
Atualizado
2023-02-13
·
CVE-2013-4254
CVSS v2.0
6.9
Média
| Vetor | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 3.10.8
Description
The issue allows local users to gain privileges or cause a denial of service, resulting in a system crash due to a NULL pointer dereference. This is achieved by adding a hardware event to an event group led by a software event through the
validate event function in arch/arm/kernel/perf event.c on the ARM platform.Recommendations
For Linux kernel versions prior to 3.10.8, update to version 3.10.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the
validate event function in arch/arm/kernel/perf event.c to minimize the risk of exploitation. Avoid adding hardware events to event groups led by software events until the issue is resolved.Exploit
Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Linux Kernel
Suse