PT-2013-1032 · Linux+4 · Linux Kernel+4

Prasad Pandit · Published 2013-11-19 · Updated 2023-12-15 · CVE-2013-6383

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.11.8

Description The issue allows local users to bypass intended access restrictions via a crafted ioctl call due to the lack of privilege level checking in the aac compat ioctl function. This could potentially lead to privilege escalation.

Recommendations For Linux kernel versions prior to 3.11.8, update to version 3.11.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the aac compat ioctl function to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2013-1133

ALT-PU-2014-1422

ALT-PU-2014-1606

BDU:2014-00099

CESA-2014_0475

CVE-2013-6383

DSA-2906-1

MGASA-2013-0371

MGASA-2013-0372

MGASA-2013-0373

MGASA-2013-0374

MGASA-2013-0375

RHSA-2014:0100

RHSA-2014:0285

RHSA-2014:0475

RHSA-2014:0476

RHSA-2014:0634

RHSA-2014_0285

RHSA-2014_0475

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2066-1

USN-2067-1

USN-2068-1

USN-2069-1

USN-2070-1

USN-2071-1

USN-2072-1

USN-2073-1

USN-2074-1

USN-2075-1

USN-2076-1

USN-2107-1

USN-2108-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

References · 91

• 🔥 https://github.com/luan0ap/cve-2018-14634 · Exploit
• https://github.com/torvalds/linux/commit/f856567b930dfcdbc3323261bf77240ccdde01f5 · Patch
• http://ubuntu.com/usn/USN-2074-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2073-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2071-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-6383 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0285.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-3023.html · Vendor Advisory
• http://ubuntu.com/usn/USN-2073-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6383 · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.11.8 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2067-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6383 · Security Note
• https://ubuntu.com/security/notices/USN-2066-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-2066-1 · Vendor Advisory