PT-2014-3028 · Linux · Linux Kernel

Publicado 2014-01-14 · Atualizado 2017-08-29 · CVE-2013-6123

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue is related to multiple array index errors in the MSM camera driver, specifically in the msm cam server.c file. These errors can be exploited by attackers to gain privileges, leveraging access to camera device nodes. The affected functions include (1) msm ctrl cmd done, (2) msm ioctl server, and (3) msm server send ctrl.

Recommendations For Linux kernel version 3.x, consider restricting access to the camera device nodes to minimize the risk of exploitation. As a temporary workaround, disabling the msm ctrl cmd done, msm ioctl server, and msm server send ctrl functions may help mitigate the issue until a patch is available.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-6123

Produtos afetados

Linux Kernel

Referências · 8

• 🔥 https://codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=60e4af06161d91d5aeaa04c7d6e9f4345a6acdd4 · Exploit
• https://cve.org/CVERecord?id=CVE-2013-6123 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90505 · Nota
• https://codeaurora.org/projects/security-advisories/out-bounds-array-access-camera-driver-cve-2013-6123 · Aviso do Fabricante
• https://codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=7beb04ea945a7178e61d935918d3cb152996b558 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-6123 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-6123 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6123 · Aviso do Fabricante