PT-2013-2708 · Linux+3 · Linux Kernel+3

Emese Revfy · Published 2013-03-22 · Updated 2014-02-07 · CVE-2013-0914

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.8.4

Description The issue allows local users to bypass the ASLR protection mechanism. This is achieved through a crafted application containing a sigaction system call, which exploits the preservation of the sa restorer field value across an exec operation by the flush signal handlers function in kernel/signal.c.

Recommendations For Linux kernel versions prior to 3.8.4, update to version 3.8.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the sigaction system call until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2013_1051

CVE-2013-0914

DSA-2668-1

OPENSUSE-SU-2013_1187-1

RHSA-2013:0829

RHSA-2013:1034

RHSA-2013:1051

RHSA-2013:1080

RHSA-2013_1034

RHSA-2013_1051

SUSE-SU-2015:0481-1

SUSE-SU-2015:0652-1

USN-1787-1

USN-1788-1

USN-1792-1

USN-1793-1

USN-1794-1

USN-1795-1

USN-1796-1

USN-1797-1

USN-1798-1

Affected Products

Centos

Linux Kernel

Red Hat

Suse

References · 38

• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0914 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:176 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-0914 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-1051.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1798-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1793-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1794-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-0914 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1787-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1788-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1794-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-2537.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-1797-1 · Vendor Advisory
• http://ubuntu.com/usn/USN-1797-1 · Vendor Advisory