PT-2013-1101 · Linux+2 · Linux Kernel+2

Theodore Tso · Published 2013-02-18 · Updated 2023-02-13 · CVE-2013-2015

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.7.3

Description The issue allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media. This is due to the ext4 orphan del function in fs/ext4/namei.c not properly handling orphan-list entries for non-journal filesystems. Multiple vulnerabilities in the Linux package of the Debian GNU/Linux operating system can be exploited by a local attacker, potentially leading to breaches of confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions prior to 3.7.3, update to version 3.7.3 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for other affected versions.

Fix

DoS

Information Disclosure

Weakness Enumeration

CWE-399

CWE-200

Related Identifiers

BDU:2015-03064

CVE-2013-2015

DSA-2668-1

DSA-2669-1

MGASA-2013-0342

MGASA-2013-0343

MGASA-2013-0344

MGASA-2013-0345

MGASA-2013-0346

SUSE-SU-2015:0652-1

SUSE-SU-2016:2074-1

Affected Products

Debian

Linux Kernel

Suse

References · 177

• https://github.com/torvalds/linux/commit/0e9a9a1ad619e7e987815d20262d36a2f95717ca · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3235 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3225 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2015 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3076 · Security Note
• https://osv.dev/vulnerability/MGASA-2013-0342 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1929 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2016:2074-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2013-0345 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3227 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2015 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2013-0342.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2015 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2094 · Security Note