CVE-2013-2547 | BDVDB-2026-55007 Detail
Description#
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.ubuntu.com/usn/USN-1796-1
- https://github.com/torvalds/linux/commit/9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
- http://www.ubuntu.com/usn/USN-1797-1
- http://www.openwall.com/lists/oss-security/2013/03/05/13
- http://www.ubuntu.com/usn/USN-1793-1
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html
- http://www.ubuntu.com/usn/USN-1794-1
- http://www.ubuntu.com/usn/USN-1795-1
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.