The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 15, 2013 |
| Suse | — | Upgrade kernel-traceUpgrade kernel-ec2Upgrade kernel-sourceUpgrade kernel-ec2-baseUpgrade kernel-xen-develUpgrade kernel-debug-baseUpgrade kernel-pae-develUpgrade kernel-pae-baseUpgrade kernel-symsUpgrade kernel-vanillaUpgrade kernel-ec2-develUpgrade kernel-desktopUpgrade kernel-desktop-baseUpgrade kernel-docsUpgrade kernel-xenUpgrade kernel-default-develUpgrade kernel-vanilla-develUpgrade kernel-xen-baseUpgrade kernel-trace-develUpgrade kernel-trace-baseUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-source-vanillaUpgrade kernel-debug-develUpgrade kernel-paeUpgrade kernel-develUpgrade kernel-desktop-develUpgrade kernel-debug | Jan 9, 2014 | Mar 15, 2013 |
| Ubuntu | — | Upgrade linux-image-3.5.0-27-powerpc-smpUpgrade linux-image-3.2.0-40-generic-paeUpgrade linux-image-3.5.0-222-omap4Upgrade linux-image-3.2.0-40-powerpc64-smpUpgrade linux-image-3.5.0-27-powerpc64-smpUpgrade linux-image-3.2.0-40-genericUpgrade linux-image-3.2.0-1429-omap4Upgrade linux-image-3.5.0-27-highbankUpgrade linux-image-3.2.0-40-powerpc-smpUpgrade linux-image-3.2.0-40-highbankUpgrade linux-image-3.2.0-40-virtualUpgrade linux-image-3.5.0-27-genericUpgrade linux-image-3.5.0-27-omapUpgrade linux-image-3.2.0-40-omap | Nov 8, 2024 | Mar 15, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub