PT-2013-5169 · Linux · Linux Kernel

Jonathan Salwan · Publicado 2013-11-12 · Atualizado 2013-11-14 · CVE-2013-4740

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue relies on user-space length values for kernel-memory copies of procfs file content, allowing attackers to gain privileges or cause a denial of service (memory corruption) via an application that provides crafted values.

Recommendations For Linux kernel version 3.x, consider restricting access to the goodix tool.c file in the Goodix gt915 touchscreen driver to minimize the risk of exploitation. As a temporary workaround, avoid using crafted user-space length values for kernel-memory copies of procfs file content until a patch is available.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2013-4740

Produtos afetados

Linux Kernel

Referências · 4

• 🔥 https://codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05 · Exploit
• https://codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-4740 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/11/08/1 · Nota