4.9

CVE-2013-3233

The llcp_sock_recvmsg function in net/nfc/llcp/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable and a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Update rc6 Version <= 3.9
Linux ≫ Linux Kernel Version 3.9 Update rc1
Linux ≫ Linux Kernel Version 3.9 Update rc2
Linux ≫ Linux Kernel Version 3.9 Update rc3
Linux ≫ Linux Kernel Version 3.9 Update rc4
Linux ≫ Linux Kernel Version 3.9 Update rc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.297
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.9 3.9 6.9
AV:L/AC:L/Au:N/C:C/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103750.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104480.html
http://www.openwall.com/lists/oss-security/2013/04/14/3
http://www.ubuntu.com/usn/USN-1837-1
https://lkml.org/lkml/2013/4/14/107
Vendor Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d26d6504f23e803824e8ebd14e52d4fc0a0b09cb
https://github.com/torvalds/linux/commit/d26d6504f23e803824e8ebd14e52d4fc0a0b09cb
Vendor Advisory