PT-2013-2002 · Linux+3 · Linux Kernel+3

Mathias Krause · Published 2013-03-14 · Updated 2019-04-22 · CVE-2012-6548

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.6

Description The issue allows local users to obtain sensitive information from kernel heap memory via a crafted application. This is due to the udf encode fh function in fs/udf/namei.c not initializing a certain structure member.

Recommendations For Linux kernel versions prior to 3.6, update to version 3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the udf encode fh function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CESA-2013_1051

CVE-2012-6548

DSA-2668-1

OPENSUSE-SU-2013_1187-1

RHSA-2013:1051

RHSA-2013:1080

RHSA-2013_1051

SUSE-SU-2015:0481-1

SUSE-SU-2015:0652-1

USN-1805-1

USN-1808-1

USN-1809-1

USN-1811-1

USN-1812-1

USN-1813-1

USN-1814-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

References · 33

• https://kernel.org/pub/linux/kernel/v3.x/patch-3.6.bz2 · Patch
• https://osv.dev/vulnerability/CVE-2012-6548 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1814-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:176 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-1051.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1809-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1812-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html · Vendor Advisory
• http://ubuntu.com/usn/USN-1813-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1805-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1811-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1808-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-2537.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2012-6548 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-6548 · Vendor Advisory