PT-2014-3028 · Linux · Linux Kernel

Published 2014-01-14 · Updated 2017-08-29 · CVE-2013-6123

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions 3.x

Description The issue is related to multiple array index errors in the MSM camera driver, specifically in the msm cam server.c file. These errors can be exploited by attackers to gain privileges, leveraging access to camera device nodes. The affected functions include (1) msm ctrl cmd done, (2) msm ioctl server, and (3) msm server send ctrl.

Recommendations For Linux kernel version 3.x, consider restricting access to the camera device nodes to minimize the risk of exploitation. As a temporary workaround, disabling the msm ctrl cmd done, msm ioctl server, and msm server send ctrl functions may help mitigate the issue until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-6123

Affected Products

Linux Kernel

References · 8

• 🔥 https://codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=60e4af06161d91d5aeaa04c7d6e9f4345a6acdd4 · Exploit
• https://cve.org/CVERecord?id=CVE-2013-6123 · Security Note
• https://codeaurora.org/projects/security-advisories/out-bounds-array-access-camera-driver-cve-2013-6123 · Vendor Advisory
• https://codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=7beb04ea945a7178e61d935918d3cb152996b558 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2013-6123 · Security Note
• https://ubuntu.com/security/CVE-2013-6123 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-6123 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90505 · Note