The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.
CVSS Details
- CVSS 3.1 Base Score: 3.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2015 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 16, 2024 | Mar 2, 2015 |
| Ubuntu | — | Upgrade linux-image-3.13.0-48-powerpc-e500mcUpgrade linux-image-3.16.0-33-powerpc-e500mcUpgrade linux-image-3.13.0-48-powerpc64-embUpgrade linux-image-3.13.0-48-lowlatencyUpgrade linux-image-3.16.0-33-powerpc-smpUpgrade linux-image-3.2.0-77-powerpc-smpUpgrade linux-image-3.13.0-48-powerpc-smpUpgrade linux-image-3.2.0-77-omapUpgrade linux-image-3.2.0-77-powerpc64-smpUpgrade linux-image-3.16.0-33-generic-lpaeUpgrade linux-image-3.2.0-77-virtualUpgrade linux-image-3.16.0-33-lowlatencyUpgrade linux-image-3.16.0-33-powerpc64-embUpgrade linux-image-3.13.0-48-genericUpgrade linux-image-3.13.0-48-powerpc64-smpUpgrade linux-image-3.16.0-33-powerpc64-smpUpgrade linux-image-3.2.0-77-genericUpgrade linux-image-3.2.0-1460-omap4Upgrade linux-image-3.13.0-48-generic-lpaeUpgrade linux-image-3.16.0-33-genericUpgrade linux-image-3.2.0-77-highbankUpgrade linux-image-3.13.0-48-powerpc-e500Upgrade linux-image-3.2.0-77-generic-pae | Nov 8, 2024 | Mar 2, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub