PT-2013-4964 · Linux+2 · Linux Kernel+2

Prasad Pandit · Published 2013-09-25 · Updated 2023-08-11 · CVE-2013-4343

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.11.1

Description The issue is related to a use-after-free vulnerability in the Linux kernel, specifically in the drivers/net/tun.c file. This vulnerability can be exploited by local users to gain privileges, provided they have the CAP NET ADMIN capability. The exploitation involves providing an invalid tuntap interface name in a TUNSETIFF ioctl call.

Recommendations For Linux kernel versions through 3.11.1, update to a version later than 3.11.1 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Exploit

Fix

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2014-1422

CVE-2013-4343

RHSA-2013:1490

SUSE-SU-2019:1527-1

USN-2020-1

USN-2023-1

USN-2049-1

Affected Products

Alt Linux

Linux Kernel

Suse

References · 281

• 🔥 https://github.com/luan0ap/cve-2018-14634 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2892 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8173 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-4343 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9870 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2896 · Security Note
• https://bdu.fstec.ru/vul/2016-02003 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3645 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2888 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2929 · Security Note
• https://bdu.fstec.ru/vul/2014-00098 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2894 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-4343 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4299 · Security Note