PT-2013-5076 · Linux+2 · Linux Kernel+2

Saran Neti · Published 2013-11-19 · Updated 2023-05-19 · CVE-2013-4563

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.13

Description The issue is related to the udp6 ufo fragment function in the Linux kernel, which does not properly perform a size comparison before inserting a fragment header when UDP Fragmentation Offload (UFO) is enabled. This allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet.

Recommendations For Linux kernel versions prior to 3.13, update to version 3.13 or later to resolve the issue. As a temporary workaround, consider disabling UDP Fragmentation Offload (UFO) until a patch is available.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2013-1264

ALT-PU-2013-1289

ALT-PU-2014-1547

CVE-2013-4563

OPENSUSE-SU-2014_0205-1

USN-2113-1

USN-2117-1

Affected Products

Alt Linux

Linux Kernel

Suse

References · 291

• 🔥 https://github.com/torvalds/linux/commit/0e033e04c2678dbbe74a46b23fffb7bb918c288e · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/recvmmsg_priv_esc.rb · Exploit
• 🔥 https://github.com/saelo/cve-2014-0038 · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0e033e04c2678dbbe74a46b23fffb7bb918c288e · Exploit
• http://ubuntu.com/usn/USN-2113-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05721 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2523 · Security Note
• https://bdu.fstec.ru/vul/2015-05743 · Security Note
• https://bdu.fstec.ru/vul/2015-05751 · Security Note
• https://bdu.fstec.ru/vul/2015-05838 · Security Note
• https://bdu.fstec.ru/vul/2015-05828 · Security Note
• https://bdu.fstec.ru/vul/2015-05719 · Security Note
• https://bdu.fstec.ru/vul/2015-05810 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4563 · Vendor Advisory