PT-2014-2860 · Linux · Linux Kernel

Publicado 2014-02-10 · Atualizado 2014-09-04 · CVE-2013-4736

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.6.x through 3.x

Description The issue is related to multiple integer overflows in the JPEG engine drivers in the MSM camera driver for the Linux kernel. This can be exploited by attackers to cause a denial of service, resulting in a system crash. The exploitation is possible via a large number of commands in an ioctl call. The affected files include camera v1/gemini/msm gemini sync.c, camera v2/gemini/msm gemini sync.c, camera v2/jpeg 10/msm jpeg sync.c, gemini/msm gemini sync.c, jpeg 10/msm jpeg sync.c, and mercury/msm mercury sync.c.

Recommendations For Linux kernel versions 2.6.x through 3.x, consider applying configuration changes to restrict the number of commands in an ioctl call to prevent the denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2013-4736

Produtos afetados

Linux Kernel

Referências · 5

• https://codeaurora.org/projects/security-advisories/integer-overflow-and-signedness-issue-camera-jpeg-engines-cve-2013-4736 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4736 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-4736 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4736 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2013-4736 · Nota de Segurança