PT-2013-3614 · Linux+1 · Linux Kernel+1

Jonathan Salwan · Published 2013-11-12 · Updated 2014-02-07 · CVE-2013-2239

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenVZ modification for the Linux kernel version 2.6.32, specifically vzkernel before 042stab080.2

Description The issue allows local users to obtain sensitive information from kernel stack memory. This can be achieved via a crafted ploop driver ioctl call, related to the ploop getdevice ioc function in drivers/block/ploop/dev.c, or a crafted quotactl system call, related to the compat quotactl function in fs/quota/quota.c.

Recommendations For vzkernel before 042stab080.2, update to version 042stab080.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-2239

DSA-2766-1

Affected Products

Linux Kernel

Openvz

References · 6

• https://security-tracker.debian.org/tracker/CVE-2013-2239 · Vendor Advisory
• http://debian.org/security/2013/dsa-2766 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2239 · Security Note
• http://wiki.openvz.org/Download/kernel/rhel6-testing/042stab080.2 · Note
• https://bugs.gentoo.org/show_bug.cgi?id=475762 · Note
• http://openwall.com/lists/oss-security/2013/07/04/9 · Note