An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernel-rtUpgrade kernel | Nov 6, 2019 | Dec 4, 2018 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Dec 4, 2018 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Oct 5, 2022 | Nov 3, 2018 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Dec 4, 2018 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Nov 6, 2019 | Dec 4, 2018 |
| Suse | — | Upgrade cluster-md-kmp-defaultUpgrade kernel-docsUpgrade kernel-defaultUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade dlm-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-obs-buildUpgrade gfs2-kmp-defaultUpgrade kernel-source-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-base | Jan 18, 2019 | Dec 4, 2018 |
| Ubuntu | — | Upgrade linux-image-4.15.0-1034-oemUpgrade linux-image-4.15.0-1032-raspi2Upgrade linux-image-azureUpgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-4.18.0-14-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.18.0-1008-awsUpgrade linux-image-raspi2Upgrade linux-image-4.18.0-1008-azureUpgrade linux-image-snapdragonUpgrade linux-image-gcpUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-4.18.0-1007-kvmUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-gkeUpgrade linux-image-4.15.0-1033-awsUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-4.15.0-46-genericUpgrade linux-image-oemUpgrade linux-image-4.15.0-1030-kvmUpgrade linux-image-4.15.0-46-lowlatencyUpgrade linux-image-4.18.0-14-genericUpgrade linux-image-4.18.0-1006-gcpUpgrade linux-image-4.15.0-1028-gcpUpgrade linux-image-generic-lpaeUpgrade linux-image-oracleUpgrade linux-image-aws-hweUpgrade linux-image-4.15.0-1040-azureUpgrade linux-image-kvmUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.18.0-1009-raspi2Upgrade linux-image-4.15.0-46-snapdragonUpgrade linux-image-4.15.0-46-generic-lpaeUpgrade linux-image-4.15.0-1009-oracleUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.18.0-14-snapdragonUpgrade linux-image-awsUpgrade linux-image-4.18.0-14-lowlatency | Feb 5, 2019 | Dec 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub