The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 15, 2013 |
| Suse | — | Upgrade kernel-source-vanillaUpgrade kernel-debug-baseUpgrade kernel-paeUpgrade kernel-pae-develUpgrade kernel-default-baseUpgrade kernel-vanilla-develUpgrade kernel-defaultUpgrade kernel-desktop-develUpgrade kernel-ec2Upgrade kernel-ec2-develUpgrade kernel-trace-baseUpgrade kernel-default-develUpgrade kernel-desktop-baseUpgrade kernel-develUpgrade kernel-debugUpgrade kernel-xenUpgrade kernel-desktopUpgrade kernel-ec2-baseUpgrade kernel-sourceUpgrade kernel-debug-develUpgrade kernel-trace-develUpgrade kernel-traceUpgrade kernel-symsUpgrade kernel-xen-develUpgrade kernel-xen-baseUpgrade kernel-pae-baseUpgrade kernel-vanillaUpgrade kernel-docs | Jan 9, 2014 | Mar 15, 2013 |
| Ubuntu | — | Upgrade linux-image-3.2.0-40-powerpc-smpUpgrade linux-image-3.2.0-40-powerpc64-smpUpgrade linux-image-3.5.0-27-omapUpgrade linux-image-3.5.0-27-powerpc64-smpUpgrade linux-image-3.2.0-40-generic-paeUpgrade linux-image-3.2.0-40-genericUpgrade linux-image-3.5.0-27-powerpc-smpUpgrade linux-image-3.2.0-40-highbankUpgrade linux-image-3.2.0-40-omapUpgrade linux-image-3.5.0-27-highbankUpgrade linux-image-3.2.0-1429-omap4Upgrade linux-image-3.2.0-40-virtualUpgrade linux-image-3.5.0-27-genericUpgrade linux-image-3.5.0-222-omap4 | Nov 8, 2024 | Mar 15, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub