6

CVE-2013-2851

Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.

Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version <= 3.9.4
Linux ≫ Linux Kernel Version3.9 Updaterc1
Linux ≫ Linux Kernel Version3.9 Updaterc2
Linux ≫ Linux Kernel Version3.9 Updaterc3
Linux ≫ Linux Kernel Version3.9 Updaterc4
Linux ≫ Linux Kernel Version3.9 Updaterc5
Linux ≫ Linux Kernel Version3.9 Updaterc6
Linux ≫ Linux Kernel Version3.9 Updaterc7
Linux ≫ Linux Kernel Version3.9.0
Linux ≫ Linux Kernel Version3.9.1
Linux ≫ Linux Kernel Version3.9.2
Linux ≫ Linux Kernel Version3.9.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.08% 0.214
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6 1.5 10
AV:L/AC:H/Au:S/C:C/I:C/A:C
CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.