PT-2013-6318 · Suse+4 · Suse Linux Enterprise Kernel-Ec2-Devel+8

Petr Matousek · Published 1970-01-01 · Updated 2020-08-28 · CVE-2013-7339

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.12.8 SUSE Linux Enterprise kernel-pae-devel (affected versions not specified) SUSE Linux Enterprise kernel-xen-devel (affected versions not specified) SUSE Linux Enterprise gfs2-kmp-xen (affected versions not specified) SUSE Linux Enterprise kernel-ec2-devel (affected versions not specified)

Description The issue allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports. Multiple vulnerabilities in SUSE Linux Enterprise packages may lead to disruption of confidentiality, integrity, and availability of protected information. Exploitation of these vulnerabilities can be done remotely. A local user can cause a denial of service when using the RDS network protocol over Infiniband channels.

Recommendations For Linux kernel versions prior to 3.12.8, update to version 3.12.8 or later. For SUSE Linux Enterprise kernel-pae-devel, kernel-xen-devel, gfs2-kmp-xen, and kernel-ec2-devel, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-399

CWE-476

Related Identifiers

ALT-PU-2014-1065

ALT-PU-2014-1422

BDU:2014-00101

BDU:2015-04307

BDU:2015-04308

BDU:2015-04309

BDU:2015-04310

CESA-2014_0981

CVE-2013-7339

DSA-2906-1

OPENSUSE-SU-2014_0840-1

OPENSUSE-SU-2014_0856-1

RHSA-2014:0439

RHSA-2014:0740

RHSA-2014:0981

RHSA-2014:1101

RHSA-2014_0740

RHSA-2014_0981

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2113-1

USN-2117-1

USN-2133-1

USN-2134-1

USN-2135-1

USN-2136-1

USN-2141-1

USN-2219-1

USN-2220-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse Linux Enterprise Gfs2-Kmp-Xen

Suse Linux Enterprise Kernel-Ec2-Devel

Suse Linux Enterprise Kernel-Pae-Devel

Suse Linux Enterprise Kernel-Xen-Devel

Suse

References · 39

• 🔥 https://github.com/torvalds/linux/commit/c2349758acf1874e4c2b93fe41d072336f1a31d0 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/futex_requeue.rb · Exploit
• 🔥 https://github.com/timwr/CVE-2014-3153 · Exploit
• 🔥 https://github.com/android-rooting-tools/libfutex_exploit · Exploit
• 🔥 https://github.com/lieanu/CVE-2014-3153 · Exploit
• 🔥 https://github.com/luan0ap/cve-2018-14634 · Exploit
• 🔥 https://github.com/elongl/CVE-2014-3153 · Exploit
• 🔥 https://github.com/zerodavinci/CVE-2014-3153-exploit · Exploit
• https://bdu.fstec.ru/vul/2014-00101 · Security Note
• https://ubuntu.com/security/notices/USN-2113-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0981.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7339 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2220-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7339 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1079214 · Patch