PT-2013-5169 · Linux · Linux Kernel

Jonathan Salwan · Published 2013-11-12 · Updated 2013-11-14 · CVE-2013-4740

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue relies on user-space length values for kernel-memory copies of procfs file content, allowing attackers to gain privileges or cause a denial of service (memory corruption) via an application that provides crafted values.

Recommendations For Linux kernel version 3.x, consider restricting access to the goodix tool.c file in the Goodix gt915 touchscreen driver to minimize the risk of exploitation. As a temporary workaround, avoid using crafted user-space length values for kernel-memory copies of procfs file content until a patch is available.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2013-4740

Affected Products

Linux Kernel

References · 4

• 🔥 https://codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05 · Exploit
• https://codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-4740 · Security Note
• http://openwall.com/lists/oss-security/2013/11/08/1 · Note