The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 15, 2013 |
| Suse | — | Upgrade kernel-default-baseUpgrade kernel-ec2-baseUpgrade kernel-desktop-baseUpgrade kernel-pae-baseUpgrade kernel-xen-develUpgrade kernel-defaultUpgrade kernel-vanillaUpgrade kernel-ec2-develUpgrade kernel-docsUpgrade kernel-debug-baseUpgrade kernel-symsUpgrade kernel-desktopUpgrade kernel-develUpgrade kernel-desktop-develUpgrade kernel-xen-baseUpgrade kernel-paeUpgrade kernel-traceUpgrade kernel-debugUpgrade kernel-trace-develUpgrade kernel-source-vanillaUpgrade kernel-default-develUpgrade kernel-sourceUpgrade kernel-xenUpgrade kernel-pae-develUpgrade kernel-trace-baseUpgrade kernel-vanilla-develUpgrade kernel-ec2Upgrade kernel-debug-devel | Jan 9, 2014 | Mar 15, 2013 |
| Ubuntu | — | Upgrade linux-image-3.2.0-1429-omap4Upgrade linux-image-3.2.0-40-genericUpgrade linux-image-3.5.0-27-genericUpgrade linux-image-3.2.0-40-powerpc64-smpUpgrade linux-image-3.5.0-27-powerpc64-smpUpgrade linux-image-3.2.0-40-highbankUpgrade linux-image-3.5.0-27-highbankUpgrade linux-image-3.2.0-40-generic-paeUpgrade linux-image-3.5.0-27-powerpc-smpUpgrade linux-image-3.5.0-27-omapUpgrade linux-image-3.2.0-40-omapUpgrade linux-image-3.2.0-40-virtualUpgrade linux-image-3.2.0-40-powerpc-smpUpgrade linux-image-3.5.0-222-omap4 | Nov 8, 2024 | Mar 15, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub