PT-2013-5986 · Linux · Linux Kernel

Cubeundcube + 1 · Published 2013-11-19 · Updated 2025-02-04 · CVE-2013-6282

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 3.5.5

Description The issue arises from improper input validation in the Linux kernel, specifically in the (1) get user and (2) put user API functions on the v6k and v7 ARM platforms. This allows attackers to read or modify arbitrary kernel memory locations via a crafted application. There have been real-world incidents where this issue was exploited against Android devices in October and November 2013.

Recommendations For Linux Kernel versions prior to 3.5.5, update to version 3.5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the get user and put user API functions to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-6282

USN-2067-1

Affected Products

Linux Kernel

References · 30

• 🔥 https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/put_user_vroot.rb · Exploit
• 🔥 https://github.com/fi01/libput_user_exploit · Exploit
• 🔥 https://github.com/timwr/CVE-2013-6282 · Exploit
• 🔥 https://github.com/jeboo/bypasslkm · Exploit
• 🔥 https://github.com/fi01/libget_user_exploit · Exploit
• 🔥 https://exploit-db.com/exploits/40975 · Exploit
• 🔥 https://exploit-db.com/exploits/31574 · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8404663f81d212918ff85f493649a7991209fa04 · Exploit
• https://ubuntu.com/security/CVE-2013-6282 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8404663f81d212918ff85f493649a7991209fa04 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-6282 · Security Note
• https://osv.dev/vulnerability/CVE-2013-6282 · Vendor Advisory
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8404663f81d212918ff85f493649a7991209fa04 · Patch
• http://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5 · Vendor Advisory