CVE-2013-2147

Description

The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.

Risk Information

Base Score

5.5

MODERATE

Vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.069

Associated Vulnerability

Vulnerability	OS Platform
Linux hardware enablement kernel from Quantal (USN-1994-1) linux-image-3.5.0-42-generic_3.5.0-42.65~precise1_i386.deb	Linux
Linux hardware enablement kernel from Quantal (USN-1994-1) linux-image-3.5.0-42-generic_3.5.0-42.65~precise1_amd64.deb	Linux
Linux kernel (USN-2017-1) linux-image-3.2.0-56-generic_3.2.0-56.86_i386.deb	Linux
Linux kernel (USN-2017-1) linux-image-3.2.0-56-generic_3.2.0-56.86_amd64.deb	Linux
Linux kernel (USN-2017-1) linux-image-3.2.0-56-virtual_3.2.0-56.86_i386.deb	Linux
Linux kernel (USN-2017-1) linux-image-3.2.0-56-virtual_3.2.0-56.86_amd64.deb	Linux
Linux kernel (USN-2017-1) linux-image-3.2.0-56-generic-pae_3.2.0-56.86_i386.deb	Linux
Linux hardware enablement kernel from Raring (USN-2020-1) linux-image-3.8.0-33-generic_3.8.0-33.48~precise1_i386.deb	Linux
Linux hardware enablement kernel from Raring (USN-2020-1) linux-image-3.8.0-33-generic_3.8.0-33.48~precise1_amd64.deb	Linux
Dtrace-modules-3.8.13-26.el6uek update (ELSA-2014-3002) dtrace-modules-3.8.13-26.el6uek-0.4.2-3.el6.x86_64.rpm	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234