An issue was discovered in the Linux kernel before 4.19.3. crypto_report_one() and related functions in crypto/crypto_user.c (the crypto user configuration API) do not fully initialize structures that are copied to userspace, potentially leaking sensitive memory to user programs. NOTE: this is a CVE-2013-2547 regression but with easier exploitability because the attacker does not need a capability (however, the system must have the CONFIG_CRYPTO_USER kconfig option).
CVSS Details
- CVSS 3.1 Base Score: 4.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade kernelUpgrade kernel-rt | Nov 6, 2019 | Dec 4, 2018 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Dec 4, 2018 |
| Oracle_linux | — | Upgrade kernel-uekUpgrade kernel | Oct 5, 2022 | Nov 3, 2018 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Dec 4, 2018 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Nov 6, 2019 | Dec 4, 2018 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-devel-azureUpgrade gfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade kernel-azure-baseUpgrade ocfs2-kmp-default | Jan 18, 2019 | Dec 4, 2018 |
| Ubuntu | — | Upgrade linux-image-4.15.0-1032-raspi2Upgrade linux-image-4.18.0-14-generic-lpaeUpgrade linux-image-snapdragonUpgrade linux-image-azureUpgrade linux-image-generic-lpae-hwe-18.04Upgrade linux-image-generic-lpae-hwe-16.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-4.15.0-1034-oemUpgrade linux-image-4.18.0-1007-kvmUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-raspi2Upgrade linux-image-4.18.0-1008-awsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-46-genericUpgrade linux-image-gcpUpgrade linux-image-4.15.0-1033-awsUpgrade linux-image-gkeUpgrade linux-image-4.18.0-1008-azureUpgrade linux-image-4.18.0-1009-raspi2Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.15.0-46-generic-lpaeUpgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-aws-hweUpgrade linux-image-4.15.0-46-lowlatencyUpgrade linux-image-4.15.0-46-snapdragonUpgrade linux-image-generic-lpaeUpgrade linux-image-4.15.0-1040-azureUpgrade linux-image-oemUpgrade linux-image-4.15.0-1009-oracleUpgrade linux-image-kvmUpgrade linux-image-4.15.0-1028-gcpUpgrade linux-image-4.18.0-14-snapdragonUpgrade linux-image-4.18.0-14-genericUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-1030-kvmUpgrade linux-image-4.18.0-14-lowlatencyUpgrade linux-image-4.18.0-1006-gcp | Feb 5, 2019 | Dec 4, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub