PT-2011-5209 · Linux+3 · Linux Kernel+3
Published
1970-01-01
·
Updated
2024-06-15
·
CVE-2013-0160
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 3.7.9
Description
The issue allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device. Multiple vulnerabilities in various packages of the openSUSE and Debian GNU/Linux operating systems can lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited locally or remotely.
Recommendations
For Linux kernel versions through 3.7.9:
As a temporary workaround, consider restricting access to the /dev/ptmx device until a patch is available.
Avoid using the inotify API on the /dev/ptmx device until the issue is resolved.
For other affected packages in openSUSE and Debian GNU/Linux, restrict access to vulnerable components and apply configuration changes to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Buffer Overflow
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Debian
Linux Kernel
Suse
Opensuse