PT-2013-1028 · Linux+2 · Linux Kernel+2

Published 2013-12-14 · Updated 2024-02-01 · CVE-2013-4587

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.12.5

Description The issue allows local users to gain privileges via a large id value, specifically through an array index error in the kvm vm ioctl create vcpu function in the KVM subsystem. This can be achieved by passing a vcpu id parameter with a high value.

Recommendations For Linux kernel versions through 3.12.5, update to a version newer than 3.12.5 to resolve the issue. As a temporary workaround, consider restricting access to the kvm vm ioctl create vcpu function to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2013-1301

ALT-PU-2013-1302

ALT-PU-2013-1303

ALT-PU-2013-1312

ALT-PU-2014-1422

ALT-PU-2014-1547

BDU:2014-00094

CVE-2013-4587

DSA-2906-1

MGASA-2013-0371

MGASA-2013-0373

MGASA-2013-0374

MGASA-2013-0375

MGASA-2014-0043

OPENSUSE-SU-2014_0204-1

OPENSUSE-SU-2014_0205-1

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2109-1

USN-2110-1

USN-2113-1

USN-2117-1

USN-2128-1

USN-2129-1

USN-2135-1

USN-2136-1

USN-2138-1

USN-2139-1

USN-2141-1

Affected Products

Alt Linux

Linux Kernel

Suse

References · 89

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/recvmmsg_priv_esc.rb · Exploit
• 🔥 https://github.com/saelo/cve-2014-0038 · Exploit
• 🔥 https://github.com/luan0ap/cve-2018-14634 · Exploit
• https://github.com/torvalds/linux/commit/338c7dbadd2671189cec7faf64c84d01071b3f96 · Patch
• http://ubuntu.com/usn/USN-2129-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-4587 · Vendor Advisory
• http://ubuntu.com/usn/USN-2117-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2135-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4587 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4587 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2014-00094 · Security Note
• https://advisories.mageia.org/MGASA-2013-0374.html · Security Note
• https://ubuntu.com/security/notices/USN-2128-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-02/msg00045.html · Vendor Advisory